Date: Tue, 30 Jun 2026 17:21:34 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste <emaste@FreeBSD.org> Subject: git: 008ca5def63b - releng/15.0 - compat/linux: Avoid waitid() kernel stack disclosure Message-ID: <6a43fb1e.44f70.4629eb8@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=008ca5def63b5fd754c1acdf60bbd64786a36abc commit 008ca5def63b5fd754c1acdf60bbd64786a36abc Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2026-03-10 13:53:46 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-06-30 02:32:58 +0000 compat/linux: Avoid waitid() kernel stack disclosure Approved by: so Security: FreeBSD-SA-26:47.linux Security: CVE-2026-49424 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55812 (cherry picked from commit 9a9f93bcf1aa0059d759b2f3ea6faeb2760a11bd) (cherry picked from commit 9f8db9cc67fb86eeb2b645ce7f8aa748e99241a9) --- sys/compat/linux/linux_misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 9e9536335cf2..26a3aeee61b0 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -749,6 +749,7 @@ linux_common_wait(struct thread *td, idtype_t idtype, int id, int *statusp, error = linux_copyout_rusage(&wru.wru_self, rup); if (error == 0 && infop != NULL && td->td_retval[0] != 0) { sig = bsd_to_linux_signal(siginfo.si_signo); + memset(&lsi, 0, sizeof(lsi)); siginfo_to_lsiginfo(&siginfo, &lsi, sig); error = copyout(&lsi, infop, sizeof(lsi)); }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a43fb1e.44f70.4629eb8>