[PATCH 3.13.y-ckt 10/48] CIFS: fix type confusion in copy offload ioctl

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 10/48] CIFS: fix type confusion in copy offload ioctl
Date	2015-10-27 22:50 +0100
Message-ID	<qoki0-21H-67@gated-at.bofh.it> (permalink)
References	<qok8h-1XT-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt29 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jann@thejh.net>

commit 4c17a6d56bb0cad3066a714e94f7185a24b40f49 upstream.

This might lead to local privilege escalation (code execution as
kernel) for systems where the following conditions are met:

 - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled
 - a cifs filesystem is mounted where:
  - the mount option "vers" was used and set to a value >=2.0
  - the attacker has write access to at least one file on the filesystem

To attack this, an attacker would have to guess the target_tcon
pointer (but guessing wrong doesn't cause a crash, it just returns an
error code) and win a narrow race.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/cifs/ioctl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index dfc9564..31df9bc 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -67,6 +67,12 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
 		goto out_drop_write;
 	}
 
+	if (src_file.file->f_op->unlocked_ioctl != cifs_ioctl) {
+		rc = -EBADF;
+		cifs_dbg(VFS, "src file seems to be from a different filesystem type\n");
+		goto out_fput;
+	}
+
 	if ((!src_file.file->private_data) || (!dst_file->private_data)) {
 		rc = -EBADF;
 		cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt29 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
  [PATCH 3.13.y-ckt 27/48] usb: Use the USB_SS_MULT() macro to get the burst multiplier. Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 16/48] arm64: head.S: initialise mdcr_el2 in el2_setup Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 21/48] x86/platform: Fix Geode LX timekeeping in the generic x86 build Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 07/48] spi: Fix documentation of spi_alloc_master() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 23/48] arm64: errata: add module build workaround for erratum #843419 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 03/48] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 15/48] btrfs: skip waiting on ordered range for special files Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 29/48] usb: xhci: Clear XHCI_STATE_DYING on start Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 24/48] arm64: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 28/48] xhci: give command abortion one more chance before killing xhci Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 18/48] iser-target: remove command with state ISTATE_REMOVE Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 26/48] KVM: x86: trap AMD MSRs for the TSeg base and mask Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 12/48] USB: option: add ZTE PIDs Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 05/48] [stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 11/48] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 14/48] Btrfs: fix read corruption of compressed and shared extents Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 04/48] KEYS: Don't permit request_key() to construct a new keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 25/48] arm: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 06/48] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 20/48] powerpc/mm: Recompute hash value after a failed update Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 10/48] CIFS: fix type confusion in copy offload ioctl Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 08/48] ARM: 8429/1: disable GCC SRA optimization Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 02/48] KEYS: Fix race between key destruction and finding a keyring by name Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 09/48] powerpc/MSI: Fix race condition in tearing down MSI interrupts Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 13/48] x86/apic: Serialize LVTT and TSC_DEADLINE writes Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100

csiph-web