CVE-2014-3917 DoS with syscall auditing (rhbz 1102571 1102715)
This commit is contained in:
Josh Boyer
parent
5024391080
commit
9532e08a65
128
auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
Normal file
128
auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
Bugzilla: 1102715
|
||||||
|
Upstream-status: Submitted for 3.15 and CC'd to stable
|
||||||
|
Delivered-To: jwboyer@gmail.com
|
||||||
|
Received: by 10.76.6.212 with SMTP id d20csp285523oaa;
|
||||||
|
Wed, 28 May 2014 20:10:58 -0700 (PDT)
|
||||||
|
X-Received: by 10.66.250.166 with SMTP id zd6mr4872927pac.7.1401333057574;
|
||||||
|
Wed, 28 May 2014 20:10:57 -0700 (PDT)
|
||||||
|
Return-Path: <stable-owner@vger.kernel.org>
|
||||||
|
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
|
||||||
|
by mx.google.com with ESMTP id j1si26042371pbw.214.2014.05.28.20.10.31
|
||||||
|
for <multiple recipients>;
|
||||||
|
Wed, 28 May 2014 20:10:57 -0700 (PDT)
|
||||||
|
Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67;
|
||||||
|
Authentication-Results: mx.google.com;
|
||||||
|
spf=neutral (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) smtp.mail=stable-owner@vger.kernel.org
|
||||||
|
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||||
|
id S1755059AbaE2DKa (ORCPT <rfc822;takashi.bg@gmail.com>
|
||||||
|
+ 73 others); Wed, 28 May 2014 23:10:30 -0400
|
||||||
|
Received: from mx1.redhat.com ([209.132.183.28]:34907 "EHLO mx1.redhat.com"
|
||||||
|
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
|
||||||
|
id S1753861AbaE2DK3 (ORCPT <rfc822;stable@vger.kernel.org>);
|
||||||
|
Wed, 28 May 2014 23:10:29 -0400
|
||||||
|
Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26])
|
||||||
|
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3AQfK017267
|
||||||
|
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);
|
||||||
|
Wed, 28 May 2014 23:10:26 -0400
|
||||||
|
Received: from paris.rdu.redhat.com (paris.rdu.redhat.com [10.13.136.28])
|
||||||
|
by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3APd7019240;
|
||||||
|
Wed, 28 May 2014 23:10:26 -0400
|
||||||
|
From: Eric Paris <eparis@redhat.com>
|
||||||
|
To: torvalds@linux-foundation.org
|
||||||
|
Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
|
||||||
|
Andy Lutomirski <luto@amacapital.net>, stable@vger.kernel.org,
|
||||||
|
Eric Paris <eparis@redhat.com>
|
||||||
|
Subject: [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking
|
||||||
|
Date: Wed, 28 May 2014 23:09:58 -0400
|
||||||
|
Message-Id: <1401332999-15167-1-git-send-email-eparis@redhat.com>
|
||||||
|
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
|
||||||
|
Sender: stable-owner@vger.kernel.org
|
||||||
|
Precedence: bulk
|
||||||
|
List-ID: <stable.vger.kernel.org>
|
||||||
|
X-Mailing-List: stable@vger.kernel.org
|
||||||
|
|
||||||
|
From: Andy Lutomirski <luto@amacapital.net>
|
||||||
|
|
||||||
|
Fixes an easy DoS and possible information disclosure.
|
||||||
|
|
||||||
|
This does nothing about the broken state of x32 auditing.
|
||||||
|
|
||||||
|
eparis: If the admin has enabled auditd and has specifically loaded audit
|
||||||
|
rules. This bug has been around since before git. Wow...
|
||||||
|
|
||||||
|
Cc: stable@vger.kernel.org
|
||||||
|
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||||
|
Signed-off-by: Eric Paris <eparis@redhat.com>
|
||||||
|
---
|
||||||
|
kernel/auditsc.c | 27 ++++++++++++++++++---------
|
||||||
|
1 file changed, 18 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
|
||||||
|
index 254ce20..842f58a 100644
|
||||||
|
--- a/kernel/auditsc.c
|
||||||
|
+++ b/kernel/auditsc.c
|
||||||
|
@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
|
||||||
|
return AUDIT_BUILD_CONTEXT;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
|
||||||
|
+{
|
||||||
|
+ int word, bit;
|
||||||
|
+
|
||||||
|
+ if (val > 0xffffffff)
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
+ word = AUDIT_WORD(val);
|
||||||
|
+ if (word >= AUDIT_BITMASK_SIZE)
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
+ bit = AUDIT_BIT(val);
|
||||||
|
+
|
||||||
|
+ return rule->mask[word] & bit;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* At syscall entry and exit time, this filter is called if the
|
||||||
|
* audit_state is not low enough that auditing cannot take place, but is
|
||||||
|
* also not high enough that we already know we have to write an audit
|
||||||
|
@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
|
||||||
|
|
||||||
|
rcu_read_lock();
|
||||||
|
if (!list_empty(list)) {
|
||||||
|
- int word = AUDIT_WORD(ctx->major);
|
||||||
|
- int bit = AUDIT_BIT(ctx->major);
|
||||||
|
-
|
||||||
|
list_for_each_entry_rcu(e, list, list) {
|
||||||
|
- if ((e->rule.mask[word] & bit) == bit &&
|
||||||
|
+ if (audit_in_mask(&e->rule, ctx->major) &&
|
||||||
|
audit_filter_rules(tsk, &e->rule, ctx, NULL,
|
||||||
|
&state, false)) {
|
||||||
|
rcu_read_unlock();
|
||||||
|
@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
|
||||||
|
static int audit_filter_inode_name(struct task_struct *tsk,
|
||||||
|
struct audit_names *n,
|
||||||
|
struct audit_context *ctx) {
|
||||||
|
- int word, bit;
|
||||||
|
int h = audit_hash_ino((u32)n->ino);
|
||||||
|
struct list_head *list = &audit_inode_hash[h];
|
||||||
|
struct audit_entry *e;
|
||||||
|
enum audit_state state;
|
||||||
|
|
||||||
|
- word = AUDIT_WORD(ctx->major);
|
||||||
|
- bit = AUDIT_BIT(ctx->major);
|
||||||
|
-
|
||||||
|
if (list_empty(list))
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
list_for_each_entry_rcu(e, list, list) {
|
||||||
|
- if ((e->rule.mask[word] & bit) == bit &&
|
||||||
|
+ if (audit_in_mask(&e->rule, ctx->major) &&
|
||||||
|
audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
|
||||||
|
ctx->current_state = state;
|
||||||
|
return 1;
|
||||||
|
--
|
||||||
|
1.9.0
|
||||||
|
|
||||||
|
--
|
||||||
|
To unsubscribe from this list: send the line "unsubscribe stable" in
|
||||||
|
the body of a message to majordomo@vger.kernel.org
|
||||||
|
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
||||||
@ -638,6 +638,9 @@ Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
|
|||||||
Patch25071: s390-appldata-add-slab.h-for-kzalloc-kfree.patch
|
Patch25071: s390-appldata-add-slab.h-for-kzalloc-kfree.patch
|
||||||
|
|
||||||
|
|
||||||
|
# CVE-2014-3917 rhbz 1102571 1102715
|
||||||
|
Patch25093: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
|
||||||
|
|
||||||
# END OF PATCH DEFINITIONS
|
# END OF PATCH DEFINITIONS
|
||||||
|
|
||||||
%endif
|
%endif
|
||||||
@ -1352,6 +1355,9 @@ ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
|
|||||||
|
|
||||||
ApplyPatch s390-appldata-add-slab.h-for-kzalloc-kfree.patch
|
ApplyPatch s390-appldata-add-slab.h-for-kzalloc-kfree.patch
|
||||||
|
|
||||||
|
# CVE-2014-3917 rhbz 1102571 1102715
|
||||||
|
ApplyPatch auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
|
||||||
|
|
||||||
# END OF PATCH APPLICATIONS
|
# END OF PATCH APPLICATIONS
|
||||||
|
|
||||||
%endif
|
%endif
|
||||||
@ -2222,6 +2228,9 @@ fi
|
|||||||
# ||----w |
|
# ||----w |
|
||||||
# || ||
|
# || ||
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu May 29 2014 Josh Boyer <jwboyer@fedoraproject.org>
|
||||||
|
- CVE-2014-3917 DoS with syscall auditing (rhbz 1102571 1102715)
|
||||||
|
|
||||||
* Wed May 28 2014 Josh Boyer <jwboyer@fedoraproject.org> - 3.15.0-0.rc7.git2.1
|
* Wed May 28 2014 Josh Boyer <jwboyer@fedoraproject.org> - 3.15.0-0.rc7.git2.1
|
||||||
- Linux v3.15-rc7-53-g4efdedca9326
|
- Linux v3.15-rc7-53-g4efdedca9326
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user