fix #47820 CVE-2016-0728
This commit is contained in:
parent
c535d9e534
commit
8837f9ef14
78
CVE-2016-0728.patch
Normal file
78
CVE-2016-0728.patch
Normal file
@ -0,0 +1,78 @@
|
||||
From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
|
||||
From: Yevgeny Pats <yevgeny@perception-point.io>
|
||||
Date: Tue, 19 Jan 2016 22:09:04 +0000
|
||||
Subject: [PATCH] KEYS: Fix keyring ref leak in join_session_keyring()
|
||||
|
||||
This fixes CVE-2016-0728.
|
||||
|
||||
If a thread is asked to join as a session keyring the keyring that's already
|
||||
set as its session, we leak a keyring reference.
|
||||
|
||||
This can be tested with the following program:
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <keyutils.h>
|
||||
|
||||
int main(int argc, const char *argv[])
|
||||
{
|
||||
int i = 0;
|
||||
key_serial_t serial;
|
||||
|
||||
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
|
||||
"leaked-keyring");
|
||||
if (serial < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (keyctl(KEYCTL_SETPERM, serial,
|
||||
KEY_POS_ALL | KEY_USR_ALL) < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
|
||||
for (i = 0; i < 100; i++) {
|
||||
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
|
||||
"leaked-keyring");
|
||||
if (serial < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
If, after the program has run, there something like the following line in
|
||||
/proc/keys:
|
||||
|
||||
3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
|
||||
|
||||
with a usage count of 100 * the number of times the program has been run,
|
||||
then the kernel is malfunctioning. If leaked-keyring has zero usages or
|
||||
has been garbage collected, then the problem is fixed.
|
||||
|
||||
Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
|
||||
Signed-off-by: David Howells <dhowells@redhat.com>
|
||||
Acked-by: Don Zickus <dzickus@redhat.com>
|
||||
Acked-by: Prarit Bhargava <prarit@redhat.com>
|
||||
Acked-by: Jarod Wilson <jarod@redhat.com>
|
||||
Signed-off-by: James Morris <james.l.morris@oracle.com>
|
||||
---
|
||||
security/keys/process_keys.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
|
||||
index a3f85d2a..e6d50172 100644
|
||||
--- a/security/keys/process_keys.c
|
||||
+++ b/security/keys/process_keys.c
|
||||
@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
|
||||
ret = PTR_ERR(keyring);
|
||||
goto error2;
|
||||
} else if (keyring == new->session_keyring) {
|
||||
+ key_put(keyring);
|
||||
ret = 0;
|
||||
goto error2;
|
||||
}
|
9
PKGBUILD
9
PKGBUILD
@ -21,7 +21,8 @@ source=("https://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz"
|
||||
'linux.preset'
|
||||
'change-default-console-loglevel.patch'
|
||||
'0001-sdhci-revert.patch'
|
||||
'tpmdd-devel-v3-base-platform-fix-binding-for-drivers-without-probe-callback.patch')
|
||||
'tpmdd-devel-v3-base-platform-fix-binding-for-drivers-without-probe-callback.patch'
|
||||
'CVE-2016-0728.patch')
|
||||
|
||||
sha256sums=('401d7c8fef594999a460d10c72c5a94e9c2e1022f16795ec51746b0d165418b2'
|
||||
'SKIP'
|
||||
@ -30,7 +31,8 @@ sha256sums=('401d7c8fef594999a460d10c72c5a94e9c2e1022f16795ec51746b0d165418b2'
|
||||
'f0d90e756f14533ee67afda280500511a62465b4f76adcc5effa95a40045179c'
|
||||
'1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99'
|
||||
'5313df7cb5b4d005422bd4cd0dae956b2dadba8f3db904275aaf99ac53894375'
|
||||
'ab57037ecee0a425c612babdff47c831378bca0bff063a1308599989a350226d')
|
||||
'ab57037ecee0a425c612babdff47c831378bca0bff063a1308599989a350226d'
|
||||
'03bed5b1c6ef34a917e218a46d38cd1347c5ab5693131996113c6cad275dc4e9')
|
||||
validpgpkeys=(
|
||||
'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds
|
||||
'647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman
|
||||
@ -56,6 +58,9 @@ prepare() {
|
||||
# https://bugzilla.kernel.org/show_bug.cgi?id=110751
|
||||
patch -Np1 -i "${srcdir}/tpmdd-devel-v3-base-platform-fix-binding-for-drivers-without-probe-callback.patch"
|
||||
|
||||
# fixes #47820 CVE-2016-0728.patch
|
||||
patch -Np1 -i "${srcdir}/CVE-2016-0728.patch"
|
||||
|
||||
# set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param)
|
||||
# remove this when a Kconfig knob is made available by upstream
|
||||
# (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
|
||||
|
Loading…
Reference in New Issue
Block a user