From owner-svn-src-head@FreeBSD.ORG Wed Oct 22 23:35:33 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 50AF3F89; Wed, 22 Oct 2014 23:35:33 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 22348368; Wed, 22 Oct 2014 23:35:33 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s9MNZXrw045168; Wed, 22 Oct 2014 23:35:33 GMT (envelope-from cperciva@FreeBSD.org) Received: (from cperciva@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s9MNZW62045167; Wed, 22 Oct 2014 23:35:32 GMT (envelope-from cperciva@FreeBSD.org) Message-Id: <201410222335.s9MNZW62045167@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: cperciva set sender to cperciva@FreeBSD.org using -f From: Colin Percival Date: Wed, 22 Oct 2014 23:35:32 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r273487 - head/sys/kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2014 23:35:33 -0000 Author: cperciva Date: Wed Oct 22 23:35:32 2014 New Revision: 273487 URL: https://svnweb.freebsd.org/changeset/base/273487 Log: Avoid leaking data from the kernel environment: When we convert the initial static environment to a dynamic one, zero the static environment buffer, and zero individual values when kern_unsetenv and freeenv are called. Tested by: kmoore (VM memory dump + grep) Tested by: cperciva (kernel panic dump + grep) Modified: head/sys/kern/kern_environment.c Modified: head/sys/kern/kern_environment.c ============================================================================== --- head/sys/kern/kern_environment.c Wed Oct 22 22:27:51 2014 (r273486) +++ head/sys/kern/kern_environment.c Wed Oct 22 23:35:32 2014 (r273487) @@ -224,7 +224,7 @@ init_static_kenv(char *buf, size_t len) static void init_dynamic_kenv(void *data __unused) { - char *cp; + char *cp, *cpnext; size_t len; int i; @@ -232,7 +232,8 @@ init_dynamic_kenv(void *data __unused) M_WAITOK | M_ZERO); i = 0; if (kern_envp && *kern_envp != '\0') { - for (cp = kern_envp; cp != NULL; cp = kernenv_next(cp)) { + for (cp = kern_envp; cp != NULL; cp = cpnext) { + cpnext = kernenv_next(cp); len = strlen(cp) + 1; if (len > KENV_MNAMELEN + 1 + KENV_MVALLEN + 1) { printf( @@ -243,6 +244,7 @@ init_dynamic_kenv(void *data __unused) if (i < KENV_SIZE) { kenvp[i] = malloc(len, M_KENV, M_WAITOK); strcpy(kenvp[i++], cp); + memset(cp, 0, strlen(cp)); } else printf( "WARNING: too many kenv strings, ignoring %s\n", @@ -260,8 +262,10 @@ void freeenv(char *env) { - if (dynamic_kenv) + if (dynamic_kenv) { + memset(env, 0, strlen(env)); free(env, M_KENV); + } } /* @@ -437,6 +441,7 @@ kern_unsetenv(const char *name) kenvp[i++] = kenvp[j]; kenvp[i] = NULL; mtx_unlock(&kenv_lock); + memset(oldenv, 0, strlen(oldenv)); free(oldenv, M_KENV); return (0); }