[linux] 09/11: KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings (CVE-2017-7472)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Wed Apr 26 23:25:02 UTC 2017
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit e065205d1ab64a7a31eea5d9e9689999e51d374d
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Wed Apr 26 23:45:38 2017 +0100
KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings (CVE-2017-7472)
---
debian/changelog | 2 +
...yctl_set_reqkey_keyring-to-not-leak-threa.patch | 176 +++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 179 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index ca80430..e86948e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -187,6 +187,8 @@ linux (3.2.88-1) UNRELEASED; urgency=medium
(CVE-2017-7294)
* packet: handle too big packets for PACKET_V3
* net/packet: Fix integer overflow in various range checks (CVE-2017-7308)
+ * KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
+ (CVE-2017-7472)
-- Ben Hutchings <ben at decadent.org.uk> Mon, 13 Mar 2017 23:12:35 +0000
diff --git a/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch b/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
new file mode 100644
index 0000000..e397f80
--- /dev/null
+++ b/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
@@ -0,0 +1,176 @@
+From: Eric Biggers <ebiggers at google.com>
+Date: Tue, 18 Apr 2017 15:31:09 +0100
+Subject: KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
+Origin: https://git.kernel.org/linus/c9f838d104fed6f2f61d68164712e3204bf5271b
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7472
+
+This fixes CVE-2017-7472.
+
+Running the following program as an unprivileged user exhausts kernel
+memory by leaking thread keyrings:
+
+ #include <keyutils.h>
+
+ int main()
+ {
+ for (;;)
+ keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
+ }
+
+Fix it by only creating a new thread keyring if there wasn't one before.
+To make things more consistent, make install_thread_keyring_to_cred()
+and install_process_keyring_to_cred() both return 0 if the corresponding
+keyring is already present.
+
+Fixes: d84f4f992cbd ("CRED: Inaugurate COW credentials")
+Cc: stable at vger.kernel.org # 2.6.29+
+Signed-off-by: Eric Biggers <ebiggers at google.com>
+Signed-off-by: David Howells <dhowells at redhat.com>
+[bwh: Backported to 3.2: adjust context]
+---
+ security/keys/keyctl.c | 11 ++++-------
+ security/keys/process_keys.c | 44 +++++++++++++++++++++++++++-----------------
+ 2 files changed, 31 insertions(+), 24 deletions(-)
+
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1183,8 +1183,8 @@ error:
+ * Read or set the default keyring in which request_key() will cache keys and
+ * return the old setting.
+ *
+- * If a process keyring is specified then this will be created if it doesn't
+- * yet exist. The old setting will be returned if successful.
++ * If a thread or process keyring is specified then it will be created if it
++ * doesn't yet exist. The old setting will be returned if successful.
+ */
+ long keyctl_set_reqkey_keyring(int reqkey_defl)
+ {
+@@ -1209,11 +1209,8 @@ long keyctl_set_reqkey_keyring(int reqke
+
+ case KEY_REQKEY_DEFL_PROCESS_KEYRING:
+ ret = install_process_keyring_to_cred(new);
+- if (ret < 0) {
+- if (ret != -EEXIST)
+- goto error;
+- ret = 0;
+- }
++ if (ret < 0)
++ goto error;
+ goto set;
+
+ case KEY_REQKEY_DEFL_DEFAULT:
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -121,13 +121,18 @@ error:
+ }
+
+ /*
+- * Install a fresh thread keyring directly to new credentials. This keyring is
+- * allowed to overrun the quota.
++ * Install a thread keyring to the given credentials struct if it didn't have
++ * one already. This is allowed to overrun the quota.
++ *
++ * Return: 0 if a thread keyring is now present; -errno on failure.
+ */
+ int install_thread_keyring_to_cred(struct cred *new)
+ {
+ struct key *keyring;
+
++ if (new->thread_keyring)
++ return 0;
++
+ keyring = keyring_alloc("_tid", new->uid, new->gid, new,
+ KEY_ALLOC_QUOTA_OVERRUN, NULL);
+ if (IS_ERR(keyring))
+@@ -138,7 +143,9 @@ int install_thread_keyring_to_cred(struc
+ }
+
+ /*
+- * Install a fresh thread keyring, discarding the old one.
++ * Install a thread keyring to the current task if it didn't have one already.
++ *
++ * Return: 0 if a thread keyring is now present; -errno on failure.
+ */
+ static int install_thread_keyring(void)
+ {
+@@ -149,8 +156,6 @@ static int install_thread_keyring(void)
+ if (!new)
+ return -ENOMEM;
+
+- BUG_ON(new->thread_keyring);
+-
+ ret = install_thread_keyring_to_cred(new);
+ if (ret < 0) {
+ abort_creds(new);
+@@ -161,10 +166,10 @@ static int install_thread_keyring(void)
+ }
+
+ /*
+- * Install a process keyring directly to a credentials struct.
++ * Install a process keyring to the given credentials struct if it didn't have
++ * one already. This is allowed to overrun the quota.
+ *
+- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
+- * and other value on any other error
++ * Return: 0 if a process keyring is now present; -errno on failure.
+ */
+ int install_process_keyring_to_cred(struct cred *new)
+ {
+@@ -172,7 +177,7 @@ int install_process_keyring_to_cred(stru
+ int ret;
+
+ if (new->tgcred->process_keyring)
+- return -EEXIST;
++ return 0;
+
+ keyring = keyring_alloc("_pid", new->uid, new->gid,
+ new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
+@@ -193,11 +198,9 @@ int install_process_keyring_to_cred(stru
+ }
+
+ /*
+- * Make sure a process keyring is installed for the current process. The
+- * existing process keyring is not replaced.
++ * Install a process keyring to the current task if it didn't have one already.
+ *
+- * Returns 0 if there is a process keyring by the end of this function, some
+- * error otherwise.
++ * Return: 0 if a process keyring is now present; -errno on failure.
+ */
+ static int install_process_keyring(void)
+ {
+@@ -211,14 +214,18 @@ static int install_process_keyring(void)
+ ret = install_process_keyring_to_cred(new);
+ if (ret < 0) {
+ abort_creds(new);
+- return ret != -EEXIST ? ret : 0;
++ return ret;
+ }
+
+ return commit_creds(new);
+ }
+
+ /*
+- * Install a session keyring directly to a credentials struct.
++ * Install the given keyring as the session keyring of the given credentials
++ * struct, replacing the existing one if any. If the given keyring is NULL,
++ * then install a new anonymous session keyring.
++ *
++ * Return: 0 on success; -errno on failure.
+ */
+ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
+ {
+@@ -258,8 +265,11 @@ int install_session_keyring_to_cred(stru
+ }
+
+ /*
+- * Install a session keyring, discarding the old one. If a keyring is not
+- * supplied, an empty one is invented.
++ * Install the given keyring as the session keyring of the current task,
++ * replacing the existing one if any. If the given keyring is NULL, then
++ * install a new anonymous session keyring.
++ *
++ * Return: 0 on success; -errno on failure.
+ */
+ static int install_session_keyring(struct key *keyring)
+ {
diff --git a/debian/patches/series b/debian/patches/series
index 0f304bf..eceba54 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1120,6 +1120,7 @@ bugfix/all/packet-handle-too-big-packets-for-packet_v3.patch
bugfix/all/net-packet-fix-overflow-in-check-for-priv-area-size.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_frame_nr.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_reserve.patch
+bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
# ABI maintenance
debian/perf-hide-abi-change-in-3.2.30.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list