)]}'
{
  "commit": "982f7c2b2e6a28f8f266e075d92e19c0dd4c6e56",
  "tree": "a25ab8534b9f43cb90292ed125dfb9d72fee9858",
  "parents": [
    "64aab720bdf8771214a7c88872bd8e3194c2d279"
  ],
  "author": {
    "name": "Dan Rosenberg",
    "email": "drosenberg@vsecurity.com",
    "time": "Thu Sep 30 15:15:31 2010 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Fri Oct 01 10:50:58 2010 -0700"
  },
  "message": "sys_semctl: fix kernel stack leakage\n\nThe semctl syscall has several code paths that lead to the leakage of\nuninitialized kernel stack memory (namely the IPC_INFO, SEM_INFO,\nIPC_STAT, and SEM_STAT commands) during the use of the older, obsolete\nversion of the semid_ds struct.\n\nThe copy_semid_to_user() function declares a semid_ds struct on the stack\nand copies it back to the user without initializing or zeroing the\n\"sem_base\", \"sem_pending\", \"sem_pending_last\", and \"undo\" pointers,\nallowing the leakage of 16 bytes of kernel stack memory.\n\nThe code is still reachable on 32-bit systems - when calling semctl()\nnewer glibc\u0027s automatically OR the IPC command with the IPC_64 flag, but\ninvoking the syscall directly allows users to use the older versions of\nthe struct.\n\nSigned-off-by: Dan Rosenberg \u003cdan.j.rosenberg@gmail.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "40a8f462a8224b298690cb07892f93afe8c15214",
      "old_mode": 33188,
      "old_path": "ipc/sem.c",
      "new_id": "0e0d49bbb867f239be5690968227c53e7c0226c0",
      "new_mode": 33188,
      "new_path": "ipc/sem.c"
    }
  ]
}