[kernel] r22862 - in dists/trunk/linux/debian: . patches patches/bugfix/all
Ben Hutchings
benh at moszumanska.debian.org
Mon Jul 27 18:12:37 UTC 2015
Author: benh
Date: Mon Jul 27 18:12:37 2015
New Revision: 22862
Log:
KEYS: ensure we free the assoc array edit if edit is valid (CVE-2015-1333)
Added:
dists/trunk/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
Modified:
dists/trunk/linux/debian/changelog
dists/trunk/linux/debian/patches/series
Modified: dists/trunk/linux/debian/changelog
==============================================================================
--- dists/trunk/linux/debian/changelog Mon Jul 27 13:27:47 2015 (r22861)
+++ dists/trunk/linux/debian/changelog Mon Jul 27 18:12:37 2015 (r22862)
@@ -8,6 +8,7 @@
modules, to reduce kernel image size (fixes FTBFS)
* debian/rules.real: Use dpkg-parsechangelog -S
* [rt] Update to 4.1.3-rt3 and re-enable
+ * KEYS: ensure we free the assoc array edit if edit is valid (CVE-2015-1333)
[ Ian Campbell ]
* [armhf] Set CONFIG_ARM_TEGRA_CPUFREQ as builtin.
Added: dists/trunk/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/trunk/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch Mon Jul 27 18:12:37 2015 (r22862)
@@ -0,0 +1,39 @@
+From: Colin Ian King <colin.king at canonical.com>
+Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid
+Origin: https://marc.info/?l=oss-security&m=143800676725867&w=2
+
+__key_link_end is not freeing the associated array edit structure
+and this leads to a 512 byte memory leak each time an identical
+existing key is added with add_key().
+
+The reason the add_key() system call returns okay is that
+key_create_or_update() calls __key_link_begin() before checking to see
+whether it can update a key directly rather than adding/replacing - which
+it turns out it can. Thus __key_link() is not called through
+__key_instantiate_and_link() and __key_link_end() must cancel the edit.
+
+CVE-2015-1333
+
+Signed-off-by: Colin Ian King <colin.king at canonical.com>
+Signed-off-by: David Howells <dhowells at redhat.com>
+---
+
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index e72548b5897e..d33437007ad2 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
+ if (index_key->type == &key_type_keyring)
+ up_write(&keyring_serialise_link_sem);
+
+- if (edit && !edit->dead_leaf) {
+- key_payload_reserve(keyring,
+- keyring->datalen - KEYQUOTA_LINK_BYTES);
++ if (edit) {
++ if (!edit->dead_leaf) {
++ key_payload_reserve(keyring,
++ keyring->datalen - KEYQUOTA_LINK_BYTES);
++ }
+ assoc_array_cancel_edit(edit);
+ }
+ up_write(&keyring->sem);
Modified: dists/trunk/linux/debian/patches/series
==============================================================================
--- dists/trunk/linux/debian/patches/series Mon Jul 27 13:27:47 2015 (r22861)
+++ dists/trunk/linux/debian/patches/series Mon Jul 27 18:12:37 2015 (r22862)
@@ -87,3 +87,4 @@
bugfix/x86/0007-x86-nmi-64-Improve-nested-NMI-comments.patch
bugfix/x86/0008-x86-nmi-64-Reorder-nested-NMI-checks.patch
bugfix/x86/0009-x86-nmi-64-Use-DF-to-avoid-userspace-RSP-confusing-n.patch
+bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
More information about the Kernel-svn-changes
mailing list