According to sashiko: "The embedded struct device_attribute attr has its show and mode fields initialized later in this function, but its store function pointer remains uninitialized heap garbage. When the sysfs file is created, a process with the DAC_OVERRIDE capability can bypass the 0444 mode restriction and write to the file. This causes dev_attr_store() to execute the uninitialized store pointer, leading to arbitrary kernel code execution." Use kzalloc_obj() instead to address this issue. Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target") Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_IDLETIMER.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index fe7d8d19629b..8a1d95d21991 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -196,7 +196,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info) { int ret; - info->timer = kmalloc_obj(*info->timer); + info->timer = kzalloc_obj(*info->timer); if (!info->timer) { ret = -ENOMEM; goto out; -- 2.47.3