rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.
Vulnerability ID: CVE-2012-3540
CWE: CWE-20
Severity score: 4.9
Project: https://github.com/openstack/horizon
Published: 2012-09-05
File: horizon/views/auth_forms.py
Commit message: Fix open redirect in Horizon.

LP 1039077. Disallow login redirects to anywhere other than the same origin.

Change-Id: I36e8e4f30cf440ecc73534af38fcd8d2a111a603
Commit author: Paul McMillan

Vulnerable version (before fix):
 from django.conf import settings from django.contrib import messages from django.contrib.auth import REDIRECT_FIELD_NAME from django.utils.translation import ugettext as _ from keystoneclient import exceptions as keystone_exceptions  def handle(self, request, data):         request.session['region_endpoint'] = endpoint         request.session['region_name'] = region_name          redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, "")          if data.get('tenant', None):             try:

Fixed version (after fix):
 from django.conf import settings from django.contrib import messages from django.contrib.auth import REDIRECT_FIELD_NAME from django.utils.http import same_origin from django.utils.translation import ugettext as _ from keystoneclient import exceptions as keystone_exceptions  def handle(self, request, data):         request.session['region_endpoint'] = endpoint         request.session['region_name'] = region_name          redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, None)         # Make sure the requested redirect matches the protocol,         # domain, and port of this request         if redirect_to and not same_origin(                 request.build_absolute_uri(redirect_to),                 request.build_absolute_uri()):             redirect_to = None          if data.get('tenant', None):             try:

Patch:
patch: @@ -28,6 +28,7 @@
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.utils.http import same_origin
 from django.utils.translation import ugettext as _
 from keystoneclient import exceptions as keystone_exceptions
 
@@ -94,7 +95,13 @@ def handle(self, request, data):
         request.session['region_endpoint'] = endpoint
         request.session['region_name'] = region_name
 
-        redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, "")
+        redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, None)
+        # Make sure the requested redirect matches the protocol,
+        # domain, and port of this request
+        if redirect_to and not same_origin(
+                request.build_absolute_uri(redirect_to),
+                request.build_absolute_uri()):
+            redirect_to = None
 
         if data.get('tenant', None):
             try:
path: horizon/views/auth_forms.py
Vulnerability: Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations.
Vulnerability ID: CVE-2012-4391
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/owncloud/core
Published: 2012-09-05
File: core/ajax/appconfig.php
Commit message: Added XSRF check
Commit author: Lukas Reschke

Vulnerable version (before fix):
  require_once ("../../lib/base.php"); OC_Util::checkAdminUser();  $action=isset($_POST['action'])?$_POST['action']:$_GET['action']; $result=false;

Fixed version (after fix):
  require_once ("../../lib/base.php"); OC_Util::checkAdminUser(); OCP\JSON::callCheck();  $action=isset($_POST['action'])?$_POST['action']:$_GET['action']; $result=false;

Patch:
patch: @@ -7,6 +7,7 @@
 
 require_once ("../../lib/base.php");
 OC_Util::checkAdminUser();
+OCP\JSON::callCheck();
 
 $action=isset($_POST['action'])?$_POST['action']:$_GET['action'];
 $result=false;
path: core/ajax/appconfig.php
Vulnerability: Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Vulnerability ID: CVE-2012-4394
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/owncloud/core
Published: 2012-09-05
File: apps/files/js/filelist.js
Commit message: Sanitizing file names
Commit author: Lukas Reschke

Vulnerable version (before fix):
 FileList={ 			var extension=false; 		} 		html+='<td class="filename" style="background-image:url('+img+')"><input type="checkbox" />'; 		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename 		if(extension){ 			html+='<span class="extension">'+extension+'</span>'; 		}

Fixed version (after fix):
 FileList={ 			var extension=false; 		} 		html+='<td class="filename" style="background-image:url('+img+')"><input type="checkbox" />'; 		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename 		if(extension){ 			html+='<span class="extension">'+extension+'</span>'; 		}

Patch:
patch: @@ -14,7 +14,7 @@ FileList={
 			var extension=false;
 		}
 		html+='<td class="filename" style="background-image:url('+img+')"><input type="checkbox" />';
-		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename
+		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename
 		if(extension){
 			html+='<span class="extension">'+extension+'</span>';
 		}
path: apps/files/js/filelist.js
Vulnerability: Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.
Vulnerability ID: CVE-2012-4395
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/owncloud/core
Published: 2012-09-05
File: index.php
Commit message: fixed xss vulnerability
Commit author: Bjoern Schiessle

Vulnerable version (before fix):
 	if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){ 		$sectoken=rand(1000000,9999999); 		$_SESSION['sectoken']=$sectoken; 		$redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI']; 		OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url)); 	} }

Fixed version (after fix):
 	if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){ 		$sectoken=rand(1000000,9999999); 		$_SESSION['sectoken']=$sectoken; 		$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI']; 		OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url)); 	} }

Patch:
patch: @@ -118,7 +118,7 @@
 	if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){
 		$sectoken=rand(1000000,9999999);
 		$_SESSION['sectoken']=$sectoken;
-		$redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI'];
+		$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI'];
 		OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url));
 	}
 }
path: index.php
Vulnerability: The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call.
Vulnerability ID: CVE-2012-4467
CWE: CWE-399
Severity score: 9.2
Project: https://github.com/torvalds/linux
Published: 2012-10-10
File: net/socket.c
Commit message: Fix order of arguments to compat_put_time[spec|val]

Commit 644595f89620 ("compat: Handle COMPAT_USE_64BIT_TIME in
net/socket.c") introduced a bug where the helper functions to take
either a 64-bit or compat time[spec|val] got the arguments in the wrong
order, passing the kernel stack pointer off as a user pointer (and vice
versa).

Because of the user address range check, that in turn then causes an
EFAULT due to the user pointer range checking failing for the kernel
address.  Incorrectly resuling in a failed system call for 32-bit
processes with a 64-bit kernel.

On odder architectures like HP-PA (with separate user/kernel address
spaces), it can be used read kernel memory.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Mikulas Patocka

Vulnerable version (before fix):
 static int do_siocgstamp(struct net *net, struct socket *sock, 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv); 	set_fs(old_fs); 	if (!err) 		err = compat_put_timeval(up, &ktv);  	return err; } static int do_siocgstampns(struct net *net, struct socket *sock, 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts); 	set_fs(old_fs); 	if (!err) 		err = compat_put_timespec(up, &kts);  	return err; }

Fixed version (after fix):
 static int do_siocgstamp(struct net *net, struct socket *sock, 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv); 	set_fs(old_fs); 	if (!err) 		err = compat_put_timeval(&ktv, up);  	return err; } static int do_siocgstampns(struct net *net, struct socket *sock, 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts); 	set_fs(old_fs); 	if (!err) 		err = compat_put_timespec(&kts, up);  	return err; }

Patch:
patch: @@ -2604,7 +2604,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
 	set_fs(old_fs);
 	if (!err)
-		err = compat_put_timeval(up, &ktv);
+		err = compat_put_timeval(&ktv, up);
 
 	return err;
 }
@@ -2620,7 +2620,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
 	set_fs(old_fs);
 	if (!err)
-		err = compat_put_timespec(up, &kts);
+		err = compat_put_timespec(&kts, up);
 
 	return err;
 }
path: net/socket.c
Vulnerability: The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.
Vulnerability ID: CVE-2012-4565
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-12-21
File: net/ipv4/tcp_illinois.c
Commit message: net: fix divide by zero in tcp algorithm illinois

Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.

The division by zero occur in tcp_illinois_info() at:
 do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)

Steps to Reproduce:
 1. Register tcp_illinois:
     # sysctl -w net.ipv4.tcp_congestion_control=illinois
 2. Monitor internal TCP information via command "ss -i"
     # watch -d ss -i
 3. Establish new TCP conn to machine

Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.

This is only related to reading stats.  The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params().  Thus, simply fix tcp_illinois_info().

Function tcp_illinois_info() / get_info() is called without
socket lock.  Thus, eliminate any race condition on ca->cnt_rtt
by using a local stack variable.  Simply reuse info.tcpv_rttcnt,
as its already set to ca->cnt_rtt.
Function avg_delay() is not affected by this race condition, as
its called with the socket lock.

Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Jesper Dangaard Brouer

Vulnerable version (before fix):
 static void tcp_illinois_info(struct sock *sk, u32 ext, 			.tcpv_rttcnt = ca->cnt_rtt, 			.tcpv_minrtt = ca->base_rtt, 		}; 		u64 t = ca->sum_rtt;  		do_div(t, ca->cnt_rtt); 		info.tcpv_rtt = t;  		nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); 	} }

Fixed version (after fix):
 static void tcp_illinois_info(struct sock *sk, u32 ext, 			.tcpv_rttcnt = ca->cnt_rtt, 			.tcpv_minrtt = ca->base_rtt, 		};  		if (info.tcpv_rttcnt > 0) { 			u64 t = ca->sum_rtt;  			do_div(t, info.tcpv_rttcnt); 			info.tcpv_rtt = t; 		} 		nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); 	} }

Patch:
patch: @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
 			.tcpv_rttcnt = ca->cnt_rtt,
 			.tcpv_minrtt = ca->base_rtt,
 		};
-		u64 t = ca->sum_rtt;
 
-		do_div(t, ca->cnt_rtt);
-		info.tcpv_rtt = t;
+		if (info.tcpv_rttcnt > 0) {
+			u64 t = ca->sum_rtt;
 
+			do_div(t, info.tcpv_rttcnt);
+			info.tcpv_rtt = t;
+		}
 		nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
 	}
 }
path: net/ipv4/tcp_illinois.c
Vulnerability: appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors.  NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393.
Vulnerability ID: CVE-2012-4752
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/owncloud/core
Published: 2012-09-05
File: core/ajax/appconfig.php
Commit message: Check for admin user
Commit author: Lukas Reschke

Vulnerable version (before fix):
  */  require_once ("../../lib/base.php"); OC_JSON::checkLoggedIn(); $action=isset($_POST['action'])?$_POST['action']:$_GET['action']; $result=false;

Fixed version (after fix):
  */  require_once ("../../lib/base.php"); OC_Util::checkAdminUser(); OC_JSON::checkLoggedIn(); $action=isset($_POST['action'])?$_POST['action']:$_GET['action']; $result=false;

Patch:
patch: @@ -6,6 +6,7 @@
  */
 
 require_once ("../../lib/base.php");
+OC_Util::checkAdminUser();
 OC_JSON::checkLoggedIn();
 $action=isset($_POST['action'])?$_POST['action']:$_GET['action'];
 $result=false;
path: core/ajax/appconfig.php
Vulnerability: Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters.
Vulnerability ID: CVE-2012-5608
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/owncloud/core
Published: 2012-12-18
File: apps/user_webdavauth/settings.php
Commit message: Remove uneeded debug output
Commit author: Lukas Reschke

Vulnerable version (before fix):
  *  */  print_r($_POST); if($_POST) {  		if(isset($_POST['webdav_url'])) {

Fixed version (after fix):
  *  */  if($_POST) {  		if(isset($_POST['webdav_url'])) {

Patch:
patch: @@ -21,7 +21,6 @@
  *
  */
 
-print_r($_POST);
 if($_POST) {
 
 		if(isset($_POST['webdav_url'])) {
path: apps/user_webdavauth/settings.php
Vulnerability: Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in OpenShift 0.0.5 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors.
Vulnerability ID: CVE-2012-5622
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/openshift/origin-server
Published: 2012-12-18
File: openshift-console/app/controllers/application_controller.rb
Commit message: BZ878754 No CSRF attack protection in console
Commit author: Chris Alfonso

Vulnerable version (before fix):
 class ApplicationController < ActionController::Base   include Console::Rescue    protect_from_forgery end

Fixed version (after fix):
 class ApplicationController < ActionController::Base   include Console::Rescue    protect_from_forgery    protected     def handle_unverified_request       raise Console::AccessDenied, "Request authenticity token does not match session #{session.inspect}"     end end

Patch:
patch: @@ -2,4 +2,9 @@ class ApplicationController < ActionController::Base
   include Console::Rescue
 
   protect_from_forgery
+
+  protected
+    def handle_unverified_request
+      raise Console::AccessDenied, "Request authenticity token does not match session #{session.inspect}"
+    end
 end
path: openshift-console/app/controllers/application_controller.rb
Vulnerability: node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.
Vulnerability ID: CVE-2012-5646
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/openshift/origin-server
Published: 2013-02-24
File: node-util/www/html/restorer.php
Commit message: Fix for Bug 880699

restorer.php security patch
Commit author: Jhon Honce

Vulnerable version (before fix):
 <?php  list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]); shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");  sleep(2); $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]); header("Location: $url");  ?>

Fixed version (after fix):
 <?php  list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]); if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {     shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");     sleep(2);     $host = $_SERVER['HTTP_HOST'];     $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';     $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);     header("Location: $proto$host$url"); } else {     // someone is trying to attack     error_log("Invalid uuid $uuid given to restorer.php");     header('HTTP/1.0 403 Forbidden'); } ?>

Patch:
patch: @@ -1,10 +1,16 @@
 <?php
 
 list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
-shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
-
-sleep(2);
-$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
-header("Location: $url");
-
+if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
+    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
+    sleep(2);
+    $host = $_SERVER['HTTP_HOST'];
+    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
+    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
+    header("Location: $proto$host$url");
+} else {
+    // someone is trying to attack
+    error_log("Invalid uuid $uuid given to restorer.php");
+    header('HTTP/1.0 403 Forbidden');
+}
 ?>
path: node-util/www/html/restorer.php
Vulnerability: The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
Vulnerability ID: CVE-2012-6538
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/xfrm/xfrm_user.c
Commit message: xfrm_user: fix info leak in copy_to_user_auth()

copy_to_user_auth() fails to initialize the remainder of alg_name and
therefore discloses up to 54 bytes of heap memory via netlink to
userland.

Use strncpy() instead of strcpy() to fill the trailing bytes of alg_name
with null bytes.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 		return -EMSGSIZE;  	algo = nla_data(nla); 	strcpy(algo->alg_name, auth->alg_name); 	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8); 	algo->alg_key_len = auth->alg_key_len; 

Fixed version (after fix):
 static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) 		return -EMSGSIZE;  	algo = nla_data(nla); 	strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name)); 	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8); 	algo->alg_key_len = auth->alg_key_len; 

Patch:
patch: @@ -742,7 +742,7 @@ static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
 		return -EMSGSIZE;
 
 	algo = nla_data(nla);
-	strcpy(algo->alg_name, auth->alg_name);
+	strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
 	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
 	algo->alg_key_len = auth->alg_key_len;
path: net/xfrm/xfrm_user.c
Vulnerability: The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2012-6539
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/socket.c
Commit message: net: fix info leak in compat dev_ifconf()

The implementation of dev_ifconf() for the compat ioctl interface uses
an intermediate ifc structure allocated in userland for the duration of
the syscall. Though, it fails to initialize the padding bytes inserted
for alignment and that for leaks four bytes of kernel stack. Add an
explicit memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32) 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf))) 		return -EFAULT;  	if (ifc32.ifcbuf == 0) { 		ifc32.ifc_len = 0; 		ifc.ifc_len = 0;

Fixed version (after fix):
 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32) 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf))) 		return -EFAULT;  	memset(&ifc, 0, sizeof(ifc)); 	if (ifc32.ifcbuf == 0) { 		ifc32.ifc_len = 0; 		ifc.ifc_len = 0;

Patch:
patch: @@ -2657,6 +2657,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
 		return -EFAULT;
 
+	memset(&ifc, 0, sizeof(ifc));
 	if (ifc32.ifcbuf == 0) {
 		ifc32.ifc_len = 0;
 		ifc.ifc_len = 0;
path: net/socket.c