diff --git a/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch new file mode 100644 index 000000000..1a7763767 --- /dev/null +++ b/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch @@ -0,0 +1,128 @@ +Bugzilla: 1102715 +Upstream-status: Submitted for 3.15 and CC'd to stable +Delivered-To: jwboyer@gmail.com +Received: by 10.76.6.212 with SMTP id d20csp285523oaa; + Wed, 28 May 2014 20:10:58 -0700 (PDT) +X-Received: by 10.66.250.166 with SMTP id zd6mr4872927pac.7.1401333057574; + Wed, 28 May 2014 20:10:57 -0700 (PDT) +Return-Path: +Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) + by mx.google.com with ESMTP id j1si26042371pbw.214.2014.05.28.20.10.31 + for ; + Wed, 28 May 2014 20:10:57 -0700 (PDT) +Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67; +Authentication-Results: mx.google.com; + spf=neutral (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) smtp.mail=stable-owner@vger.kernel.org +Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1755059AbaE2DKa (ORCPT + + 73 others); Wed, 28 May 2014 23:10:30 -0400 +Received: from mx1.redhat.com ([209.132.183.28]:34907 "EHLO mx1.redhat.com" + rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP + id S1753861AbaE2DK3 (ORCPT ); + Wed, 28 May 2014 23:10:29 -0400 +Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) + by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3AQfK017267 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); + Wed, 28 May 2014 23:10:26 -0400 +Received: from paris.rdu.redhat.com (paris.rdu.redhat.com [10.13.136.28]) + by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3APd7019240; + Wed, 28 May 2014 23:10:26 -0400 +From: Eric Paris +To: torvalds@linux-foundation.org +Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, + Andy Lutomirski , stable@vger.kernel.org, + Eric Paris +Subject: [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking +Date: Wed, 28 May 2014 23:09:58 -0400 +Message-Id: <1401332999-15167-1-git-send-email-eparis@redhat.com> +X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 +Sender: stable-owner@vger.kernel.org +Precedence: bulk +List-ID: +X-Mailing-List: stable@vger.kernel.org + +From: Andy Lutomirski + +Fixes an easy DoS and possible information disclosure. + +This does nothing about the broken state of x32 auditing. + +eparis: If the admin has enabled auditd and has specifically loaded audit +rules. This bug has been around since before git. Wow... + +Cc: stable@vger.kernel.org +Signed-off-by: Andy Lutomirski +Signed-off-by: Eric Paris +--- + kernel/auditsc.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 254ce20..842f58a 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key) + return AUDIT_BUILD_CONTEXT; + } + ++static int audit_in_mask(const struct audit_krule *rule, unsigned long val) ++{ ++ int word, bit; ++ ++ if (val > 0xffffffff) ++ return false; ++ ++ word = AUDIT_WORD(val); ++ if (word >= AUDIT_BITMASK_SIZE) ++ return false; ++ ++ bit = AUDIT_BIT(val); ++ ++ return rule->mask[word] & bit; ++} ++ + /* At syscall entry and exit time, this filter is called if the + * audit_state is not low enough that auditing cannot take place, but is + * also not high enough that we already know we have to write an audit +@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, + + rcu_read_lock(); + if (!list_empty(list)) { +- int word = AUDIT_WORD(ctx->major); +- int bit = AUDIT_BIT(ctx->major); +- + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, NULL, + &state, false)) { + rcu_read_unlock(); +@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, + static int audit_filter_inode_name(struct task_struct *tsk, + struct audit_names *n, + struct audit_context *ctx) { +- int word, bit; + int h = audit_hash_ino((u32)n->ino); + struct list_head *list = &audit_inode_hash[h]; + struct audit_entry *e; + enum audit_state state; + +- word = AUDIT_WORD(ctx->major); +- bit = AUDIT_BIT(ctx->major); +- + if (list_empty(list)) + return 0; + + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) { + ctx->current_state = state; + return 1; +-- +1.9.0 + +-- +To unsubscribe from this list: send the line "unsubscribe stable" in +the body of a message to majordomo@vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/kernel.spec b/kernel.spec index fc06e993f..b076aa1dd 100644 --- a/kernel.spec +++ b/kernel.spec @@ -638,6 +638,9 @@ Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch Patch25071: s390-appldata-add-slab.h-for-kzalloc-kfree.patch +# CVE-2014-3917 rhbz 1102571 1102715 +Patch25093: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch + # END OF PATCH DEFINITIONS %endif @@ -1352,6 +1355,9 @@ ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch ApplyPatch s390-appldata-add-slab.h-for-kzalloc-kfree.patch +# CVE-2014-3917 rhbz 1102571 1102715 +ApplyPatch auditsc-audit_krule-mask-accesses-need-bounds-checking.patch + # END OF PATCH APPLICATIONS %endif @@ -2222,6 +2228,9 @@ fi # ||----w | # || || %changelog +* Thu May 29 2014 Josh Boyer +- CVE-2014-3917 DoS with syscall auditing (rhbz 1102571 1102715) + * Wed May 28 2014 Josh Boyer - 3.15.0-0.rc7.git2.1 - Linux v3.15-rc7-53-g4efdedca9326