kern/45142: bpf_filter() can leak kernel stack contents

[guy%alum.mit.edu@localhost]

>Number:         45142
>Category:       kern
>Synopsis:       bpf_filter() can leak kernel stack contents
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 14 00:55:00 +0000 2011
>Originator:     Guy Harris
>Release:        Any
>Organization:
>Environment:
N/A (bug discovered by looking at the OpenBSD CVS repository)
>Description:
    http://seclists.org/fulldisclosure/2010/Nov/89

That's Linux's BPF interpreter, but the same problem exists with the *BSD BPF 
interpreter:

    
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/bpf_filter.c.diff?r1=1.21;r2=1.22

    
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/bpf_filter.c?rev=1.22;content-type=text%2Fx-cvsweb-markup

>How-To-Repeat:
A bit more work on *BSD, as, unlike Linux, *BSD doesn't let you slap a BPF 
filter on arbitrary sockets, but there's probably something you can cook up, 
based on Dan's program.
>Fix:
Do a bzero() or memset(..., 0, ...) to clear out mem before you start running 
the BPF program (but after you do the "if no filter, just return 0xffffffff" 
check).