Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1614513

[PATCH 3.2 4/4] keys: Guard against null match function in keyring_search_aux()

Show all headers | View raw

3.2.88-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

The "dead" key type has no match operation, and a search for keys of
this type can cause a null dereference in keyring_search_aux().
keyring_search() has a check for this, but request_keyring_and_link()
does not.  Move the check into keyring_search_aux(), covering both of
them.

This was fixed upstream by commit c06cfb08b88d ("KEYS: Remove
key_type::match in favour of overriding default by match_preparse"),
part of a series of large changes that are not suitable for
backporting.

CVE-2017-2647 / CVE-2017-6951

Reported-by: Igor Redko <redkoi@virtuozzo.com>
Reported-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2647
Reported-by: idl3r <idler1984@gmail.com>
References: https://www.spinics.net/lists/keyrings/msg01845.html
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: David Howells <dhowells@redhat.com>
---
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -336,6 +336,9 @@ key_ref_t keyring_search_aux(key_ref_t k
 	if (keyring->type != &key_type_keyring)
 		goto error;
 
+	if (!match)
+		return ERR_PTR(-ENOKEY);
+
 	rcu_read_lock();
 
 	now = current_kernel_time();
@@ -484,9 +487,6 @@ key_ref_t keyring_search(key_ref_t keyri
 			 struct key_type *type,
 			 const char *description)
 {
-	if (!type->match)
-		return ERR_PTR(-ENOKEY);
-
 	return keyring_search_aux(keyring, current->cred,
 				  type, description, type->match, false);
 }

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 0/4] 3.2.88-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-04-01 15:30 +0200
  [PATCH 3.2 3/4] l2tp: fix racy SOCK_ZAPPED flag check in  l2tp_ip{,6}_bind() Ben Hutchings <ben@decadent.org.uk> - 2017-04-01 15:30 +0200
  [PATCH 3.2 4/4] keys: Guard against null match function in  keyring_search_aux() Ben Hutchings <ben@decadent.org.uk> - 2017-04-01 15:30 +0200
  [PATCH 3.2 2/4] mm/huge_memory.c: fix up "mm/huge_memory.c:  respect FOLL_FORCE/FOLL_COW for thp" backport Ben Hutchings <ben@decadent.org.uk> - 2017-04-01 15:30 +0200
  [PATCH 3.2 1/4] ipv4: keep skb->dst around in presence of IP  options Ben Hutchings <ben@decadent.org.uk> - 2017-04-01 15:30 +0200
  Re: [PATCH 3.2 0/4] 3.2.88-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-04-01 19:30 +0200
    Re: [PATCH 3.2 0/4] 3.2.88-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-04-02 00:50 +0200
  Re: [PATCH 3.2 0/4] 3.2.88-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-04-02 05:10 +0200

csiph-web