Description
The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
References
- FEDORA-2013-6537 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b860d3cc62877fad02863e2a08efff69a19382d2
- https://github.com/torvalds/linux/commit/b860d3cc62877fad02863e2a08efff69a19382d2
- FEDORA-2013-6999 vendor-advisory
- USN-1837-1 vendor-advisory
- [linux-kernel] 20130414 Linux 3.9-rc7 mailing-list
- [oss-security] 20130414 Linux kernel: more net info leak fixes for v3.9 mailing-list
- openSUSE-SU-2013:1971 vendor-advisory