David Howells 979e0d7465 KEYS: Make the keyring cycle detector ignore other keyrings of the same name ... This fixes CVE-2014-0102. The following command sequence produces an oops: keyctl new_session i=`keyctl newring _ses @s` keyctl link @s $i The problem is that search_nested_keyrings() sees two keyrings that have matching type and description, so keyring_compare_object() returns true. s_n_k() then passes the key to the iterator function - keyring_detect_cycle_iterator() - which *should* check to see whether this is the keyring of interest, not just one with the same name. Because assoc_array_find() will return one and only one match, I assumed that the iterator function would only see an exact match or never be called - but the iterator isn't only called from assoc_array_find()... The oops looks something like this: kernel BUG at /data/fs/linux-2.6-fscache/security/keys/keyring.c:1003! invalid opcode: 0000 [#1] SMP ... RIP: keyring_detect_cycle_iterator+0xe/0x1f ... Call Trace: search_nested_keyrings+0x76/0x2aa __key_link_check_live_key+0x50/0x5f key_link+0x4e/0x85 keyctl_keyring_link+0x60/0x81 SyS_keyctl+0x65/0xe4 tracesys+0xdd/0xe2 The fix is to make keyring_detect_cycle_iterator() check that the key it has is the key it was actually looking for rather than calling BUG_ON(). A testcase has been included in the keyutils testsuite for this: http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/commit/?id=891f3365d07f1996778ade0e3428f01878a1790b Reported-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-03-09 18:57:18 -07:00
..
apparmor
integrity
keys	KEYS: Make the keyring cycle detector ignore other keyrings of the same name	2014-03-09 18:57:18 -07:00
selinux	Merge branch 'stable-3.14' of git://git.infradead.org/users/pcmoore/selinux into for-linus	2014-02-24 14:40:16 +11:00
smack
tomoyo
yama
capability.c
commoncap.c
device_cgroup.c
inode.c
Kconfig	security: select correct default LSM_MMAP_MIN_ADDR on arm on arm64	2014-02-05 14:59:14 +00:00
lsm_audit.c
Makefile
min_addr.c
security.c