[linux] 01/01: unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun Jan 17 14:14:49 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch squeeze-security
in repository linux.
commit e27118fd9bd171281b2838870c87dbd2f84350b2
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Sun Jan 17 14:14:32 2016 +0000
unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
---
debian/changelog | 1 +
...ly-account-for-FDs-passed-over-unix-socke.patch | 130 +++++++++++++++++++++
debian/patches/series/48squeeze19 | 1 +
3 files changed, 132 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 18d4f3a..bc0dd84 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ linux-2.6 (2.6.32-48squeeze19) UNRELEASED; urgency=medium
* sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
(CVE-2015-8767)
* tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
+ * unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
-- Ben Hutchings <ben at decadent.org.uk> Thu, 14 Jan 2016 23:04:08 +0000
diff --git a/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch b/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
new file mode 100644
index 0000000..eae5ef7
--- /dev/null
+++ b/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
@@ -0,0 +1,130 @@
+From: willy tarreau <w at 1wt.eu>
+Date: Sun, 10 Jan 2016 07:54:56 +0100
+Subject: unix: properly account for FDs passed over unix sockets
+Origin: https://git.kernel.org/linus/712f4aad406bb1ed67f3f98d04c044191f0ff593
+
+It is possible for a process to allocate and accumulate far more FDs than
+the process' limit by sending them over a unix socket then closing them
+to keep the process' fd count low.
+
+This change addresses this problem by keeping track of the number of FDs
+in flight per user and preventing non-privileged processes from having
+more FDs in flight than their configured FD limit.
+
+Reported-by: socketpair at gmail.com
+Reported-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
+Mitigates: CVE-2013-4312 (Linux 2.0+)
+Suggested-by: Linus Torvalds <torvalds at linux-foundation.org>
+Acked-by: Hannes Frederic Sowa <hannes at stressinduktion.org>
+Signed-off-by: Willy Tarreau <w at 1wt.eu>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+[carnil: Backported to 3.16: adjust context]
+[bwh: Backported to 2.6.32: adjust context further]
+---
+ include/linux/sched.h | 1 +
+ net/unix/af_unix.c | 24 ++++++++++++++++++++----
+ net/unix/garbage.c | 13 ++++++++-----
+ 3 files changed, 29 insertions(+), 9 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -724,6 +724,7 @@ struct user_struct {
+ unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
+ #endif
+ unsigned long locked_shm; /* How many pages of mlocked shm ? */
++ unsigned long unix_inflight; /* How many files in flight in unix sockets */
+
+ #ifdef CONFIG_KEYS
+ struct key *uid_keyring; /* UID specific keyring */
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1445,6 +1445,21 @@ static void unix_destruct_scm(struct sk_
+ sock_wfree(skb);
+ }
+
++/*
++ * The "user->unix_inflight" variable is protected by the garbage
++ * collection lock, and we just read it locklessly here. If you go
++ * over the limit, there might be a tiny race in actually noticing
++ * it across threads. Tough.
++ */
++static inline bool too_many_unix_fds(struct task_struct *p)
++{
++ struct user_struct *user = current_user();
++
++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
++ return false;
++}
++
+ #define MAX_RECURSION_LEVEL 4
+
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+@@ -1453,6 +1468,9 @@ static int unix_attach_fds(struct scm_co
+ unsigned char max_level = 0;
+ int unix_sock_count = 0;
+
++ if (too_many_unix_fds(current))
++ return -ETOOMANYREFS;
++
+ for (i = scm->fp->count - 1; i >= 0; i--) {
+ struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+@@ -1474,10 +1492,8 @@ static int unix_attach_fds(struct scm_co
+ if (!UNIXCB(skb).fp)
+ return -ENOMEM;
+
+- if (unix_sock_count) {
+- for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
+- }
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->fp[i]);
+ skb->destructor = unix_destruct_fds;
+ return max_level;
+ }
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -126,9 +126,11 @@ struct sock *unix_get_socket(struct file
+ void unix_inflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
+ if (atomic_long_inc_return(&u->inflight) == 1) {
+ BUG_ON(!list_empty(&u->link));
+ list_add_tail(&u->link, &gc_inflight_list);
+@@ -136,22 +138,26 @@ void unix_inflight(struct file *fp)
+ BUG_ON(list_empty(&u->link));
+ }
+ unix_tot_inflight++;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight++;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ void unix_notinflight(struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
+ if (s) {
+ struct unix_sock *u = unix_sk(s);
+- spin_lock(&unix_gc_lock);
+ BUG_ON(list_empty(&u->link));
+ if (atomic_long_dec_and_test(&u->inflight))
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+- spin_unlock(&unix_gc_lock);
+ }
++ fp->f_cred->user->unix_inflight--;
++ spin_unlock(&unix_gc_lock);
+ }
+
+ static inline struct sk_buff *sock_queue_head(struct sock *sk)
diff --git a/debian/patches/series/48squeeze19 b/debian/patches/series/48squeeze19
index 60f02f3..148472f 100644
--- a/debian/patches/series/48squeeze19
+++ b/debian/patches/series/48squeeze19
@@ -1,3 +1,4 @@
+ usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
+ bugfix/all/sctp-prevent-soft-lockup-when-sctp_accept-is-called-.patch
+ bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
++ bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list