Messages in this thread Patch in this message | | | Date | Wed, 25 May 2011 09:44:00 -0500 | From | Serge Hallyn <> | Subject | Re: [Security] Fwd: Oops (bad memory deref) in slab_alloc() due to filp_cachep holding incorrect values |
| |
Quoting Robert Święcki (robert@swiecki.net): > On Wed, May 25, 2011 at 10:28 AM, Eugene Teo <eugeneteo@kernel.sg> wrote: > > Cc'ed David as well. > > > > On Tue, May 24, 2011 at 8:52 PM, Robert Święcki <robert@swiecki.net> wrote: > >> And the repro - I think this might be exploitable (user-space NULL ptr > >> deref at the first glance, in cap_capable() while in sys_setgid()). > >> Works for me with 2.6.39 and the following config: > >> http://alt.swiecki.net/linux_kernel/ise-test-2.6.39-kernel-config.txt > >> > >> It works for me with apparmor loaded, but looking at the code it > >> should work with SELinux as well (both call cap_capable()). Could be > >> some regression of http://securitytracker.com/id?1024384 > >> > >> It works with 2.6.39 but not with 2.6.39-rc4. Found with Tavis > >> Ormandy's http://code.google.com/p/iknowthis/ > > Given that it doesn't seem to appear in 2.6.39-rc4, and judging by the > names of functions involved, this change looks suspiciously related to > this oops (even if it just made the keyctl problem visible) > http://git.itanic.dy.fi/?p=linux-stable;a=commitdiff;h=47a150edc2ae734c0f4bf50aa19499e23b9a46f8 > > >> #include <sys/stat.h> > >> #include <sys/wait.h> > >> #include <unistd.h> > >> #include <sys/syscall.h> > >> #include <linux/keyctl.h> > >> #include <linux/sched.h> > >> > >> int TH1(void *dummy) { > >> syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
Thanks!
Fooi, it looks like all users of cred_alloc_blank() may need to be audited wrt commit 47a150edc2ae734c0f4bf50aa19499e23b9a46f8.
Does this fix the bug you're seeing?
From: Serge E. Hallyn <serge.hallyn@canonical.com> Date: Wed, 25 May 2011 15:41:23 +0100 Subject: [PATCH 1/1] Set cred->user_ns in key_replace_session_keyring
Since this cred was not created with copy_creds(), it needs to get initialized.
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com> --- security/keys/process_keys.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index 6c0480d..92a3a5d 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -847,6 +847,7 @@ void key_replace_session_keyring(void) new-> sgid = old-> sgid; new->fsgid = old->fsgid; new->user = get_uid(old->user); + new->user_ns = new->user->user_ns; new->group_info = get_group_info(old->group_info); new->securebits = old->securebits; -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |