diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2016-02-08 14:31:14 +0100 |
---|---|---|
committer | Sona Sarmadi <sona.sarmadi@enea.com> | 2016-02-09 08:34:01 +0100 |
commit | cd51ec36f940d713057d7727ba0862f5503545f4 (patch) | |
tree | 89e572eca0bba2969bf2b2f073c62e60773c58fa | |
parent | fa34e4b39a0d27086a2e797b637d8a1b1df89784 (diff) | |
download | meta-fsl-ppc-dizzy-enea.tar.gz |
kernel-mnt: CVE-2015-4177dizzy-enea
Fixes race conditions in collect_mounts
References:
http://seclists.org/oss-sec/2015/q2/640
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-4177
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/
patch/?id=6ab282fe6d43027b3b1ef820b3798aae8fdb432b
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
-rw-r--r-- | recipes-kernel/linux/files/mnt-CVE-2015-4177.patch | 56 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-qoriq_3.12.bb | 1 |
2 files changed, 57 insertions, 0 deletions
diff --git a/recipes-kernel/linux/files/mnt-CVE-2015-4177.patch b/recipes-kernel/linux/files/mnt-CVE-2015-4177.patch new file mode 100644 index 0000000..c6ca4bf --- /dev/null +++ b/recipes-kernel/linux/files/mnt-CVE-2015-4177.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 6ab282fe6d43027b3b1ef820b3798aae8fdb432b Mon Sep 17 00:00:00 2001 | ||
2 | From: "Eric W. Biederman" <ebiederm@xmission.com> | ||
3 | Date: Wed, 7 Jan 2015 14:28:26 -0600 | ||
4 | Subject: mnt: Fail collect_mounts when applied to unmounted mounts | ||
5 | |||
6 | commit cd4a40174b71acd021877341684d8bb1dc8ea4ae upstream. | ||
7 | |||
8 | The only users of collect_mounts are in audit_tree.c | ||
9 | |||
10 | In audit_trim_trees and audit_add_tree_rule the path passed into | ||
11 | collect_mounts is generated from kern_path passed an audit_tree | ||
12 | pathname which is guaranteed to be an absolute path. In those cases | ||
13 | collect_mounts is obviously intended to work on mounted paths and | ||
14 | if a race results in paths that are unmounted when collect_mounts | ||
15 | it is reasonable to fail early. | ||
16 | |||
17 | The paths passed into audit_tag_tree don't have the absolute path | ||
18 | check. But are used to play with fsnotify and otherwise interact with | ||
19 | the audit_trees, so again operating only on mounted paths appears | ||
20 | reasonable. | ||
21 | |||
22 | Avoid having to worry about what happens when we try and audit | ||
23 | unmounted filesystems by restricting collect_mounts to mounts | ||
24 | that appear in the mount tree. | ||
25 | |||
26 | Fixes CVE-2015-4177. | ||
27 | Upstream-Status: Backport | ||
28 | |||
29 | Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> | ||
30 | Signed-off-by: Jiri Slaby <jslaby@suse.cz> | ||
31 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
32 | --- | ||
33 | fs/namespace.c | 7 +++++-- | ||
34 | 1 file changed, 5 insertions(+), 2 deletions(-) | ||
35 | |||
36 | diff --git a/fs/namespace.c b/fs/namespace.c | ||
37 | index 247f34d..185cd1a 100644 | ||
38 | --- a/fs/namespace.c | ||
39 | +++ b/fs/namespace.c | ||
40 | @@ -1467,8 +1467,11 @@ struct vfsmount *collect_mounts(struct path *path) | ||
41 | { | ||
42 | struct mount *tree; | ||
43 | namespace_lock(); | ||
44 | - tree = copy_tree(real_mount(path->mnt), path->dentry, | ||
45 | - CL_COPY_ALL | CL_PRIVATE); | ||
46 | + if (!check_mnt(real_mount(path->mnt))) | ||
47 | + tree = ERR_PTR(-EINVAL); | ||
48 | + else | ||
49 | + tree = copy_tree(real_mount(path->mnt), path->dentry, | ||
50 | + CL_COPY_ALL | CL_PRIVATE); | ||
51 | namespace_unlock(); | ||
52 | if (IS_ERR(tree)) | ||
53 | return ERR_CAST(tree); | ||
54 | -- | ||
55 | cgit v0.11.2 | ||
56 | |||
diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bb b/recipes-kernel/linux/linux-qoriq_3.12.bb index bcf2930..9c1da76 100644 --- a/recipes-kernel/linux/linux-qoriq_3.12.bb +++ b/recipes-kernel/linux/linux-qoriq_3.12.bb | |||
@@ -36,6 +36,7 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \ | |||
36 | file://net-CVE-2015-2041.patch \ | 36 | file://net-CVE-2015-2041.patch \ |
37 | file://media-CVE-2014-1739.patch \ | 37 | file://media-CVE-2014-1739.patch \ |
38 | file://fs-userns-CVE-2014-4014.patch \ | 38 | file://fs-userns-CVE-2014-4014.patch \ |
39 | file://mnt-CVE-2015-4177.patch \ | ||
39 | " | 40 | " |
40 | SRCREV = "6619b8b55796cdf0cec04b66a71288edd3057229" | 41 | SRCREV = "6619b8b55796cdf0cec04b66a71288edd3057229" |
41 | 42 | ||