lkml.org 
[lkml]   [2017]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subject[PATCH 0/3] KEYS: Fixes
From
Date

Hi James,

Can you pass these patches onto Linus, please?

(1) Disallow keyrings whose name begins with a '.' to be joined
[CVE-2016-9604].

(2) Change the name of the dead type to ".dead" to prevent user access
[CVE-2017-6951].

(3) Fix keyctl_set_reqkey_keyring() to not leak thread keyrings
[CVE-2017-7472].

The patches can be found here also:

http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-fixes

Tagged thusly:

git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
keys-fixes-20170419

David
---
David Howells (2):
KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
KEYS: Change the name of the dead type to ".dead" to prevent user access

Eric Biggers (1):
KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings


security/keys/gc.c | 2 +-
security/keys/keyctl.c | 20 +++++++++++--------
security/keys/process_keys.c | 44 ++++++++++++++++++++++++++----------------
3 files changed, 39 insertions(+), 27 deletions(-)

\
 
 \ /
  Last update: 2017-04-19 18:12    [W:0.079 / U:0.424 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site