diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2017-09-29 12:27:59 +0200 |
---|---|---|
committer | Adrian Dudau <adrian.dudau@enea.com> | 2017-09-29 13:08:46 +0200 |
commit | 894bce5eff9262bb5376640409580c37bdc081c3 (patch) | |
tree | 60af98a70a84a8616071abab854b89a78a68fe0b | |
parent | 163efd512fede2d1a535256040895702b7b90012 (diff) | |
download | meta-enea-bsp-arm-894bce5eff9262bb5376640409580c37bdc081c3.tar.gz |
linux-cavium: CVE-2017-5551
S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)
Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-5551
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
-rw-r--r-- | recipes-kernel/linux/linux-cavium/CVE-2017-5551.patch | 53 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-cavium_4.9.inc | 1 |
2 files changed, 54 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-cavium/CVE-2017-5551.patch b/recipes-kernel/linux/linux-cavium/CVE-2017-5551.patch new file mode 100644 index 0000000..3865b5a --- /dev/null +++ b/recipes-kernel/linux/linux-cavium/CVE-2017-5551.patch | |||
@@ -0,0 +1,53 @@ | |||
1 | From 782b361c93062f083bbc9a78928498218f950399 Mon Sep 17 00:00:00 2001 | ||
2 | From: Gu Zheng <guzheng1@huawei.com> | ||
3 | Date: Mon, 9 Jan 2017 09:34:48 +0800 | ||
4 | Subject: [PATCH] tmpfs: clear S_ISGID when setting posix ACLs | ||
5 | |||
6 | commit 497de07d89c1410d76a15bec2bb41f24a2a89f31 upstream. | ||
7 | |||
8 | This change was missed the tmpfs modification in In CVE-2016-7097 | ||
9 | commit 073931017b49 ("posix_acl: Clear SGID bit when setting | ||
10 | file permissions") | ||
11 | It can test by xfstest generic/375, which failed to clear | ||
12 | setgid bit in the following test case on tmpfs: | ||
13 | |||
14 | touch $testfile | ||
15 | chown 100:100 $testfile | ||
16 | chmod 2755 $testfile | ||
17 | _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile | ||
18 | |||
19 | CVE: CVE-2017-5551 | ||
20 | Upstream-Status: Backport [from kernel.org longterm 4.9.52] | ||
21 | |||
22 | Signed-off-by: Gu Zheng <guzheng1@huawei.com> | ||
23 | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | ||
24 | Cc: Brad Spengler <spender@grsecurity.net> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
26 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
27 | --- | ||
28 | fs/posix_acl.c | 9 ++++----- | ||
29 | 1 file changed, 4 insertions(+), 5 deletions(-) | ||
30 | |||
31 | diff --git a/fs/posix_acl.c b/fs/posix_acl.c | ||
32 | index 5955220..c9d48dc 100644 | ||
33 | --- a/fs/posix_acl.c | ||
34 | +++ b/fs/posix_acl.c | ||
35 | @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) | ||
36 | int error; | ||
37 | |||
38 | if (type == ACL_TYPE_ACCESS) { | ||
39 | - error = posix_acl_equiv_mode(acl, &inode->i_mode); | ||
40 | - if (error < 0) | ||
41 | - return 0; | ||
42 | - if (error == 0) | ||
43 | - acl = NULL; | ||
44 | + error = posix_acl_update_mode(inode, | ||
45 | + &inode->i_mode, &acl); | ||
46 | + if (error) | ||
47 | + return error; | ||
48 | } | ||
49 | |||
50 | inode->i_ctime = current_time(inode); | ||
51 | -- | ||
52 | 1.9.1 | ||
53 | |||
diff --git a/recipes-kernel/linux/linux-cavium_4.9.inc b/recipes-kernel/linux/linux-cavium_4.9.inc index c3e0f33..cc3e666 100644 --- a/recipes-kernel/linux/linux-cavium_4.9.inc +++ b/recipes-kernel/linux/linux-cavium_4.9.inc | |||
@@ -17,6 +17,7 @@ SRC_URI = "git://git@git.enea.com/linux/linux-cavium.git;protocol=ssh;name=machi | |||
17 | file://dts \ | 17 | file://dts \ |
18 | file://CVE-2016-10154.patch \ | 18 | file://CVE-2016-10154.patch \ |
19 | file://CVE-2016-10208.patch \ | 19 | file://CVE-2016-10208.patch \ |
20 | file://CVE-2017-5551.patch \ | ||
20 | file://CVE-2017-7487.patch \ | 21 | file://CVE-2017-7487.patch \ |
21 | file://CVE-2017-7618.patch \ | 22 | file://CVE-2017-7618.patch \ |
22 | file://CVE-2017-7645.patch \ | 23 | file://CVE-2017-7645.patch \ |