diff options
Diffstat (limited to 'recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch')
-rw-r--r-- | recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch b/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch new file mode 100644 index 0000000..4181252 --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch | |||
@@ -0,0 +1,57 @@ | |||
1 | From 66db51c9f7b2fe7ebdfa753b2aa9abbb9feddc87 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Ian King <colin.king@canonical.com> | ||
3 | Date: Mon, 27 Jul 2015 15:23:43 +0100 | ||
4 | Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid | ||
5 | |||
6 | [ Upstream commit HEAD ] | ||
7 | |||
8 | commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. | ||
9 | |||
10 | __key_link_end is not freeing the associated array edit structure | ||
11 | and this leads to a 512 byte memory leak each time an identical | ||
12 | existing key is added with add_key(). | ||
13 | |||
14 | The reason the add_key() system call returns okay is that | ||
15 | key_create_or_update() calls __key_link_begin() before checking to see | ||
16 | whether it can update a key directly rather than adding/replacing - which | ||
17 | it turns out it can. Thus __key_link() is not called through | ||
18 | __key_instantiate_and_link() and __key_link_end() must cancel the edit. | ||
19 | |||
20 | CVE-2015-1333 | ||
21 | |||
22 | Upstream-Status: Backport | ||
23 | |||
24 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | ||
25 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
26 | Signed-off-by: James Morris <james.l.morris@oracle.com> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
28 | |||
29 | (cherry picked from commit c9cd9b18dac801040ada16562dc579d5ac366d75) | ||
30 | Signed-off-by: Sasha Levin <sasha.levin@oracle.com> | ||
31 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
32 | --- | ||
33 | security/keys/keyring.c | 8 +++++--- | ||
34 | 1 file changed, 5 insertions(+), 3 deletions(-) | ||
35 | |||
36 | diff --git a/security/keys/keyring.c b/security/keys/keyring.c | ||
37 | index e72548b..d334370 100644 | ||
38 | --- a/security/keys/keyring.c | ||
39 | +++ b/security/keys/keyring.c | ||
40 | @@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, | ||
41 | if (index_key->type == &key_type_keyring) | ||
42 | up_write(&keyring_serialise_link_sem); | ||
43 | |||
44 | - if (edit && !edit->dead_leaf) { | ||
45 | - key_payload_reserve(keyring, | ||
46 | - keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
47 | + if (edit) { | ||
48 | + if (!edit->dead_leaf) { | ||
49 | + key_payload_reserve(keyring, | ||
50 | + keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
51 | + } | ||
52 | assoc_array_cancel_edit(edit); | ||
53 | } | ||
54 | up_write(&keyring->sem); | ||
55 | -- | ||
56 | 1.9.1 | ||
57 | |||