svn commit: r325871 - releng/10.3/sys/kern

[Gordon Tetlow]

Author: gordon
Date: Wed Nov 15 22:40:46 2017
New Revision: 325871
URL: https://svnweb.freebsd.org/changeset/base/325871

Log:
  Fix kernel data leak via ptrace(PT_LWPINFO). [SA-17:08]
  
  Approved by:    so
  Security:       FreeBSD-SA-17:08.ptrace
  Security:       CVE-2017-1086

Modified:
  releng/10.3/sys/kern/sys_process.c

Modified: releng/10.3/sys/kern/sys_process.c
==============================================================================
--- releng/10.3/sys/kern/sys_process.c	Wed Nov 15 22:40:32 2017	(r325870)
+++ releng/10.3/sys/kern/sys_process.c	Wed Nov 15 22:40:46 2017	(r325871)
@@ -474,6 +474,7 @@ ptrace_lwpinfo_to32(const struct ptrace_lwpinfo *pl,
     struct ptrace_lwpinfo32 *pl32)
 {
 
+	bzero(pl32, sizeof(*pl32));
 	pl32->pl_lwpid = pl->pl_lwpid;
 	pl32->pl_event = pl->pl_event;
 	pl32->pl_flags = pl->pl_flags;
@@ -1193,6 +1194,7 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi
 		} else
 #endif
 		pl = addr;
+		bzero(pl, sizeof(*pl));
 		pl->pl_lwpid = td2->td_tid;
 		pl->pl_event = PL_EVENT_NONE;
 		pl->pl_flags = 0;
@@ -1213,8 +1215,6 @@ kern_ptrace(struct thread *td, int req, pid_t pid, voi
 				pl->pl_siginfo = td2->td_dbgksi.ksi_info;
 			}
 		}
-		if ((pl->pl_flags & PL_FLAG_SI) == 0)
-			bzero(&pl->pl_siginfo, sizeof(pl->pl_siginfo));
 		if (td2->td_dbgflags & TDB_SCE)
 			pl->pl_flags |= PL_FLAG_SCE;
 		else if (td2->td_dbgflags & TDB_SCX)