Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1330716
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 47/47] KEYS: Fix keyring ref leak in join_session_keyring() |
| Date | 2016-02-09 23:50 +0100 |
| Message-ID | <r0pgD-21e-47@gated-at.bofh.it> (permalink) |
| References | <r0pgC-21e-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt15 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Yevgeny Pats <yevgeny@perception-point.io>
commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 upstream.
This fixes CVE-2016-0728.
If a thread is asked to join as a session keyring the keyring that's already
set as its session, we leak a keyring reference.
This can be tested with the following program:
#include <stddef.h>
#include <stdio.h>
#include <sys/types.h>
#include <keyutils.h>
int main(int argc, const char *argv[])
{
int i = 0;
key_serial_t serial;
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
"leaked-keyring");
if (serial < 0) {
perror("keyctl");
return -1;
}
if (keyctl(KEYCTL_SETPERM, serial,
KEY_POS_ALL | KEY_USR_ALL) < 0) {
perror("keyctl");
return -1;
}
for (i = 0; i < 100; i++) {
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
"leaked-keyring");
if (serial < 0) {
perror("keyctl");
return -1;
}
}
return 0;
}
If, after the program has run, there something like the following line in
/proc/keys:
3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
with a usage count of 100 * the number of times the program has been run,
then the kernel is malfunctioning. If leaked-keyring has zero usages or
has been garbage collected, then the problem is fixed.
Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Don Zickus <dzickus@redhat.com>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
security/keys/process_keys.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index bd536cb..db91639 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
ret = PTR_ERR(keyring);
goto error2;
} else if (keyring == new->session_keyring) {
+ key_put(keyring);
ret = 0;
goto error2;
}
--
1.9.1
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt15 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100 [PATCH 3.19.y-ckt 47/47] KEYS: Fix keyring ref leak in join_session_keyring() Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100 [PATCH 3.19.y-ckt 41/47] perf hists: Fix HISTC_MEM_DCACHELINE width setting Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100 [PATCH 3.19.y-ckt 11/47] cdc-acm:exclude Samsung phone 04e8:685d Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 10/47] usb: cdc-acm: send zero packet for intel 7260 modem Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 17/47] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 35/47] ALSA: dummy: Disable switching timer backend via sysfs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 34/47] seccomp: always propagate NO_NEW_PRIVS on tsync Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 19/47] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 23/47] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 16/47] USB: serial: option: Adding support for Telit LE922 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 36/47] drm/vmwgfx: respect 'nomodeset' Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 24/47] ALSA: bebob: Use a signed return type for get_formation_index Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 12/47] usb: hub: do not clear BOS field during reset device Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 09/47] usb: cdc-acm: handle unlinked urb in acm read callback Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 30/47] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 21/47] USB: option: fix Cinterion AHxx enumeration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 28/47] powerpc/eeh: Fix PE location code Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 15/47] USB: serial: visor: fix crash on detecting device without write_urbs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 32/47] staging/speakup: Use tty_ldisc_ref() for paste kworker Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 22/47] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 14/47] USB: visor: fix null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 26/47] arm64: mm: avoid calling apply_to_page_range on empty range Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 27/47] x86/mm: Fix types used in pgprot cacheability flags translations Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 20/47] arm64: kernel: fix architected PMU registers unconditional access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 08/47] ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 29/47] SCSI: fix crashes in sd and sr runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 25/47] arm64: errata: Add -mpc-relative-literal-loads to build flags Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100 [PATCH 3.19.y-ckt 07/47] ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist" Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100 [PATCH 3.19.y-ckt 03/47] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100 [PATCH 3.19.y-ckt 06/47] powerpc: Simplify module TOC handling Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100 [PATCH 3.19.y-ckt 04/47] KVM: PPC: Fix ONE_REG AltiVec support Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100 [PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
csiph-web