From: Mark Vitale <mvitale@sinenomine.net>
Date: Tue, 26 Jun 2018 09:26:21 +0000 (-0400)
Subject: OPENAFS-SA-2018-002 kaserver: prevent KAM_ListEntry information leak
X-Git-Tag: openafs-devel-1_9_0~469
X-Git-Url: http://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=b604ee7a

OPENAFS-SA-2018-002 kaserver: prevent KAM_ListEntry information leak

KAM_ListEntry (kas list) does not initialize its output correctly.  It
leaks kaserver memory contents over the wire:

struct kaindex
- up to 64 bytes for member name
- up to 64 bytes for member instance

Initialize the buffer.

[kaduk@mit.edu: move initialization to top of server routine]

Change-Id: I5cc430fc996e7e89d38a384d092b9d4fad248fa4
---

diff --git a/src/kauth/kaprocs.c b/src/kauth/kaprocs.c
index 315096a..1c6c68f 100644
--- a/src/kauth/kaprocs.c
+++ b/src/kauth/kaprocs.c
@@ -1700,6 +1700,7 @@ kamListEntry(struct rx_call *call,
     afs_int32 caller;
     struct kaentry tentry;
 
+    memset(name, 0, sizeof(*name));
     COUNT_REQ(ListEntry);
     if ((code = InitAuthServ(&tt, LOCKREAD, this_op)))
 	return code;