[linux] 01/01: unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun Jan 17 09:24:11 UTC 2016
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to branch wheezy-security
in repository linux.
commit dae883c9d5807a1cfeb78a7f4b69520e94b81410
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Sun Jan 17 08:52:34 2016 +0100
unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
---
debian/changelog | 4 +
...ly-account-for-FDs-passed-over-unix-socke.patch | 129 +++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 134 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 20869db..bb6a9bb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,11 +1,15 @@
linux (3.2.73-2+deb7u3) UNRELEASED; urgency=medium
+ [ Ben Hutchings ]
* usb: serial: visor: fix crash on detecting device without write_urbs
(CVE-2015-7566)
* sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
(CVE-2015-8767)
* tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
+ [ Salvatore Bonaccorso ]
+ * unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
+
-- Ben Hutchings <ben at decadent.org.uk> Thu, 14 Jan 2016 23:30:57 +0000
linux (3.2.73-2+deb7u2) wheezy-security; urgency=medium
diff --git a/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch b/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
new file mode 100644
index 0000000..2c8526f
--- /dev/null
+++ b/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
@@ -0,0 +1,129 @@
+From: willy tarreau <w at 1wt.eu>
+Date: Sun, 10 Jan 2016 07:54:56 +0100
+Subject: unix: properly account for FDs passed over unix sockets
+Origin: https://git.kernel.org/linus/712f4aad406bb1ed67f3f98d04c044191f0ff593
+
+It is possible for a process to allocate and accumulate far more FDs than
+the process' limit by sending them over a unix socket then closing them
+to keep the process' fd count low.
+
+This change addresses this problem by keeping track of the number of FDs
+in flight per user and preventing non-privileged processes from having
+more FDs in flight than their configured FD limit.
+
+Reported-by: socketpair at gmail.com
+Reported-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
+Mitigates: CVE-2013-4312 (Linux 2.0+)
+Suggested-by: Linus Torvalds <torvalds at linux-foundation.org>
+Acked-by: Hannes Frederic Sowa <hannes at stressinduktion.org>
+Signed-off-by: Willy Tarreau <w at 1wt.eu>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+[carnil: Backported to 3.16: adjust context]
+---
+ include/linux/sched.h | 1 +
+ net/unix/af_unix.c | 24 ++++++++++++++++++++----
+ net/unix/garbage.c | 13 ++++++++-----
+ 3 files changed, 29 insertions(+), 9 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -763,6 +763,7 @@ struct user_struct {
+ unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
+ #endif
+ unsigned long locked_shm; /* How many pages of mlocked shm ? */
++ unsigned long unix_inflight; /* How many files in flight in unix sockets */
+
+ #ifdef CONFIG_KEYS
+ struct key *uid_keyring; /* UID specific keyring */
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_
+ sock_wfree(skb);
+ }
+
++/*
++ * The "user->unix_inflight" variable is protected by the garbage
++ * collection lock, and we just read it locklessly here. If you go
++ * over the limit, there might be a tiny race in actually noticing
++ * it across threads. Tough.
++ */
++static inline bool too_many_unix_fds(struct task_struct *p)
++{
++ struct user_struct *user = current_user();
++
++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
++ return false;
++}
++
+ #define MAX_RECURSION_LEVEL 4
+
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_co
+ unsigned char max_level = 0;
+ int unix_sock_count = 0;
+
++ if (too_many_unix_fds(current))
++ return -ETOOMANYREFS;
++
+ for (i = scm->fp->count - 1; i >= 0; i--) {
+ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_co
+ if (!UNIXCB(skb).fp)
+ return -ENOMEM;
+
+- if (unix_sock_count) {
+- for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
+- }
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->fp[i]);
+ return max_level;
+ }
+
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -125,9 +125,11 @@ struct sock *unix_get_socket(struct file
+ void unix_inflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
+ if (atomic_long_inc_return(&u->inflight) == 1) {
+ BUG_ON(!list_empty(&u->link));
+ list_add_tail(&u->link, &gc_inflight_list);
+@@ -135,22 +137,26 @@ void unix_inflight(struct file *fp)
+ BUG_ON(list_empty(&u->link));
+ }
+ unix_tot_inflight++;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight++;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ void unix_notinflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
+ BUG_ON(list_empty(&u->link));
+ if (atomic_long_dec_and_test(&u->inflight))
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight--;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
diff --git a/debian/patches/series b/debian/patches/series
index 8d6360b..1132f2f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1193,3 +1193,4 @@ bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch
bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
bugfix/all/sctp-prevent-soft-lockup-when-sctp_accept-is-called-.patch
bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
+bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list