diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2015-10-21 09:45:25 +0200 |
---|---|---|
committer | Tudor Florea <tudor.florea@enea.com> | 2015-10-22 12:16:45 +0200 |
commit | eed885c9afee7c93efa559df9336eb7ff7390e2c (patch) | |
tree | 1ee02259f98be53c6190071bbb7d3c9dda01ec38 | |
parent | 56fadd5827f95396b1237dfe628e2b8a3d28dd00 (diff) | |
download | meta-enea-eed885c9afee7c93efa559df9336eb7ff7390e2c.tar.gz |
kernel: CVE-2015-1333
Fixes denial of service due to memory leak in add_key()
References:
http://www.openwall.com/lists/oss-security/2015/07/27/7
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1333
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/stable/
linux-stable.git/commit/?id=4fd5dc9eece297f49f16f82422ead3a28b11ea70
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
-rw-r--r-- | recipes-kernel/linux/files/keys-CVE-2015-1333.patch | 52 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-yocto_3.14.bbappend | 1 |
2 files changed, 53 insertions, 0 deletions
diff --git a/recipes-kernel/linux/files/keys-CVE-2015-1333.patch b/recipes-kernel/linux/files/keys-CVE-2015-1333.patch new file mode 100644 index 0000000..419accf --- /dev/null +++ b/recipes-kernel/linux/files/keys-CVE-2015-1333.patch | |||
@@ -0,0 +1,52 @@ | |||
1 | From c9cd9b18dac801040ada16562dc579d5ac366d75 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Ian King <colin.king@canonical.com> | ||
3 | Date: Mon, 27 Jul 2015 15:23:43 +0100 | ||
4 | Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid | ||
5 | |||
6 | commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. | ||
7 | |||
8 | __key_link_end is not freeing the associated array edit structure | ||
9 | and this leads to a 512 byte memory leak each time an identical | ||
10 | existing key is added with add_key(). | ||
11 | |||
12 | The reason the add_key() system call returns okay is that | ||
13 | key_create_or_update() calls __key_link_begin() before checking to see | ||
14 | whether it can update a key directly rather than adding/replacing - which | ||
15 | it turns out it can. Thus __key_link() is not called through | ||
16 | __key_instantiate_and_link() and __key_link_end() must cancel the edit. | ||
17 | |||
18 | CVE-2015-1333 | ||
19 | |||
20 | Upstream-Status: Backport | ||
21 | |||
22 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | ||
23 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
24 | Signed-off-by: James Morris <james.l.morris@oracle.com> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
26 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
27 | --- | ||
28 | security/keys/keyring.c | 8 +++++--- | ||
29 | 1 file changed, 5 insertions(+), 3 deletions(-) | ||
30 | |||
31 | diff --git a/security/keys/keyring.c b/security/keys/keyring.c | ||
32 | index 2fb2576..04d0d7c 100644 | ||
33 | --- a/security/keys/keyring.c | ||
34 | +++ b/security/keys/keyring.c | ||
35 | @@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring, | ||
36 | if (index_key->type == &key_type_keyring) | ||
37 | up_write(&keyring_serialise_link_sem); | ||
38 | |||
39 | - if (edit && !edit->dead_leaf) { | ||
40 | - key_payload_reserve(keyring, | ||
41 | - keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
42 | + if (edit) { | ||
43 | + if (!edit->dead_leaf) { | ||
44 | + key_payload_reserve(keyring, | ||
45 | + keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
46 | + } | ||
47 | assoc_array_cancel_edit(edit); | ||
48 | } | ||
49 | up_write(&keyring->sem); | ||
50 | -- | ||
51 | 1.9.1 | ||
52 | |||
diff --git a/recipes-kernel/linux/linux-yocto_3.14.bbappend b/recipes-kernel/linux/linux-yocto_3.14.bbappend index d06f299..9d51809 100644 --- a/recipes-kernel/linux/linux-yocto_3.14.bbappend +++ b/recipes-kernel/linux/linux-yocto_3.14.bbappend | |||
@@ -1,4 +1,5 @@ | |||
1 | FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/files:" |
2 | 2 | ||
3 | SRC_URI += "file://HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch \ | 3 | SRC_URI += "file://HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch \ |
4 | file://keys-CVE-2015-1333.patch \ | ||
4 | " | 5 | " |