Uninitialized kernel stack leaked to unprivileged users via sysctl when ACPI get-method fails
Summary
sysctl_acpi_sony_gen_handler declares local int val without initializing ignores return status of acpi_GetInteger then hands &val to sysctl_handle_int which copies verbatim to userspace. When underlying ACPI get-method absent or fails (common for contrast/bass_gain/pcr/azp/lnp on many Sony laptops) val never written 4 bytes stale kernel stack disclosed to any unprivileged reader of sysctl. acpi_GetInteger only writes *number on ACPI_SUCCESS on AE_NOT_FOUND/AE_TYPE variable left untouched. sysctl_handle_int executes SYSCTL_OUT unconditionally. Read path requires no privilege (caps check gated on req->newptr writes only). Several registered oids refer to optional features not present on all SNY5001 implementations so method evaluation returns AE_NOT_FOUND and leak triggers deterministically. Deterministic per node repeatable trivially scripted.
No comments yet.