lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 012/177] proc: Check /proc/$pid/attr/ writes against file opener
    Date
    From: Kees Cook <keescook@chromium.org>

    commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream.

    Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
    files need to check the opener credentials, since these fds do not
    transition state across execve(). Without this, it is possible to
    trick another process (which may have different credentials) to write
    to its own /proc/$pid/attr/ files, leading to unexpected and possibly
    exploitable behaviors.

    [1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

    Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
    Cc: stable@vger.kernel.org
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/proc/base.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/proc/base.c
    +++ b/fs/proc/base.c
    @@ -2556,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struc
    void *page;
    int rv;

    + /* A task may only write when it was the opener. */
    + if (file->f_cred != current_real_cred())
    + return -EPERM;
    +
    rcu_read_lock();
    task = pid_task(proc_pid(inode), PIDTYPE_PID);
    if (!task) {

    \
     
     \ /
      Last update: 2021-05-31 17:20    [W:8.726 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site