[kernel/f18] CVE-2013-2148 fanotify: info leak in copy_event_to_user (rhbz 971258 971261)

[Josh Boyer]

commit 21d95660dd5b585622a581325901b05e41c9ef9e
Author: Josh Boyer <jwboyer at redhat.com>
Date:   Thu Jun 6 08:24:07 2013 -0400

    CVE-2013-2148 fanotify: info leak in copy_event_to_user (rhbz 971258 971261)

 fanotify-info-leak-in-copy_event_to_user.patch |   14 ++++++++++++++
 kernel.spec                                    |    7 +++++++
 2 files changed, 21 insertions(+), 0 deletions(-)
---
diff --git a/fanotify-info-leak-in-copy_event_to_user.patch b/fanotify-info-leak-in-copy_event_to_user.patch
new file mode 100644
index 0000000..92b218b
--- /dev/null
+++ b/fanotify-info-leak-in-copy_event_to_user.patch
@@ -0,0 +1,14 @@
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 6c80083..77cc85d 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -122,6 +122,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
+ 	metadata->event_len = FAN_EVENT_METADATA_LEN;
+ 	metadata->metadata_len = FAN_EVENT_METADATA_LEN;
+ 	metadata->vers = FANOTIFY_METADATA_VERSION;
++	metadata->reserved = 0;
+ 	metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
+ 	metadata->pid = pid_vnr(event->tgid);
+ 	if (unlikely(event->mask & FAN_Q_OVERFLOW))
+
+  
\ No newline at end of file
diff --git a/kernel.spec b/kernel.spec
index b11dd1b..f92c1fb 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -773,6 +773,9 @@ Patch25031: xen-blkback-Check-device-permissions-before-allowing.patch
 #CVE-2013-2147 rhbz 971242 971249
 Patch25032: cve-2013-2147-ciss-info-leak.patch
 
+#CVE-2013-2148 rhbz 971258 971261
+Patch25033: fanotify-info-leak-in-copy_event_to_user.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1484,6 +1487,9 @@ ApplyPatch xen-blkback-Check-device-permissions-before-allowing.patch
 #CVE-2013-2147 rhbz 971242 971249
 ApplyPatch cve-2013-2147-ciss-info-leak.patch
 
+#CVE-2013-2148 rhbz 971258 971261
+ApplyPatch fanotify-info-leak-in-copy_event_to_user.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2330,6 +2336,7 @@ fi
 #                 ||     ||
 %changelog
 * Thu Jun 06 2013 Josh Boyer <jwboyer at redhat.com>
+- CVE-2013-2148 fanotify: info leak in copy_event_to_user (rhbz 971258 971261)
 - CVE-2013-2147 cpqarray/cciss: information leak via ioctl (rhbz 971242 971249)
 
 * Wed Jun 05 2013 Josh Boyer <jwboyer at redhat.com>