From be7da46fb53a1b572ab376128300751832aff851 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 10 Jun 2016 14:29:25 +0200 Subject: kernel/IB: IB-CVE-2016-4565 Unprivileged process can overwrite kernel memory using rdma_ucm.ko References: =========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4565 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4565 Reference to the upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/ commit/?id=5d43a619be6f1960702daafafe87ceab415be6bc Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- .../linux/linux-hierofalcon/IB-CVE-2016-4565.patch | 160 +++++++++++++++++++++ recipes-kernel/linux/linux-hierofalcon_3.19.bb | 1 + recipes-kernel/linux/linux-hierofalcon_4.1.bb | 1 + 3 files changed, 162 insertions(+) create mode 100644 recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch (limited to 'recipes-kernel/linux') diff --git a/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch b/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch new file mode 100644 index 0000000..0bd6d5c --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch @@ -0,0 +1,160 @@ +From 5d43a619be6f1960702daafafe87ceab415be6bc Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Sun, 10 Apr 2016 19:13:13 -0600 +Subject: IB/security: Restrict use of the write() interface + +[ Upstream commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 ] + +The drivers/infiniband stack uses write() as a replacement for +bi-directional ioctl(). This is not safe. There are ways to +trigger write calls that result in the return structure that +is normally written to user space being shunted off to user +specified kernel memory instead. + +For the immediate repair, detect and deny suspicious accesses to +the write API. + +For long term, update the user space libraries and the kernel API +to something that doesn't present the same security vulnerabilities +(likely a structured ioctl() interface). + +The impacted uAPI interfaces are generally only available if +hardware from drivers/infiniband is installed in the system. + +CVE: CVE-2016-4565 +Upstream-Status: Backport + +Reported-by: Jann Horn +Signed-off-by: Linus Torvalds +Signed-off-by: Jason Gunthorpe +[ Expanded check to all known write() entry points ] +Cc: stable@vger.kernel.org +Signed-off-by: Doug Ledford + +Signed-off-by: Sasha Levin +Signed-off-by: Sona Sarmadi +--- + drivers/infiniband/core/ucm.c | 4 ++++ + drivers/infiniband/core/ucma.c | 3 +++ + drivers/infiniband/core/uverbs_main.c | 5 +++++ + drivers/infiniband/hw/qib/qib_file_ops.c | 5 +++++ + include/rdma/ib.h | 16 ++++++++++++++++ + 5 files changed, 33 insertions(+) + +diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c +index f2f6393..5befec1 100644 +--- a/drivers/infiniband/core/ucm.c ++++ b/drivers/infiniband/core/ucm.c +@@ -48,6 +48,7 @@ + + #include + ++#include + #include + #include + #include +@@ -1104,6 +1105,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, + struct ib_ucm_cmd_hdr hdr; + ssize_t result; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (len < sizeof(hdr)) + return -EINVAL; + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 45d67e9..81dd84d 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1487,6 +1487,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, + struct rdma_ucm_cmd_hdr hdr; + ssize_t ret; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (len < sizeof(hdr)) + return -EINVAL; + +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 09686d4..e063b07 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -48,6 +48,8 @@ + + #include + ++#include ++ + #include "uverbs.h" + + MODULE_AUTHOR("Roland Dreier"); +@@ -613,6 +615,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + struct ib_uverbs_cmd_hdr hdr; + __u32 flags; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (count < sizeof hdr) + return -EINVAL; + +diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c +index 7258818..619154e 100644 +--- a/drivers/infiniband/hw/qib/qib_file_ops.c ++++ b/drivers/infiniband/hw/qib/qib_file_ops.c +@@ -45,6 +45,8 @@ + #include + #include + ++#include ++ + #include "qib.h" + #include "qib_common.h" + #include "qib_user_sdma.h" +@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data, + ssize_t ret = 0; + void *dest; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(fp))) ++ return -EACCES; ++ + if (count < sizeof(cmd.type)) { + ret = -EINVAL; + goto bail; +diff --git a/include/rdma/ib.h b/include/rdma/ib.h +index cf8f9e7..a6b9370 100644 +--- a/include/rdma/ib.h ++++ b/include/rdma/ib.h +@@ -34,6 +34,7 @@ + #define _RDMA_IB_H + + #include ++#include + + struct ib_addr { + union { +@@ -86,4 +87,19 @@ struct sockaddr_ib { + __u64 sib_scope_id; + }; + ++/* ++ * The IB interfaces that use write() as bi-directional ioctl() are ++ * fundamentally unsafe, since there are lots of ways to trigger "write()" ++ * calls from various contexts with elevated privileges. That includes the ++ * traditional suid executable error message writes, but also various kernel ++ * interfaces that can write to file descriptors. ++ * ++ * This function provides protection for the legacy API by restricting the ++ * calling context. ++ */ ++static inline bool ib_safe_file_access(struct file *filp) ++{ ++ return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS); ++} ++ + #endif /* _RDMA_IB_H */ +-- +cgit v0.12 + diff --git a/recipes-kernel/linux/linux-hierofalcon_3.19.bb b/recipes-kernel/linux/linux-hierofalcon_3.19.bb index 5c24d8e..7b40313 100644 --- a/recipes-kernel/linux/linux-hierofalcon_3.19.bb +++ b/recipes-kernel/linux/linux-hierofalcon_3.19.bb @@ -38,6 +38,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-3.19;branch="standard/qemuarm6 file://Btrfs-CVE-2015-8374.patch \ file://ALSA-CVE-2016-2384.patch \ file://net-ppp-CVE-2015-8569.patch \ + file://IB-CVE-2016-4565.patch \ " S = "${WORKDIR}/git" diff --git a/recipes-kernel/linux/linux-hierofalcon_4.1.bb b/recipes-kernel/linux/linux-hierofalcon_4.1.bb index 9a0f2d7..a55415c 100644 --- a/recipes-kernel/linux/linux-hierofalcon_4.1.bb +++ b/recipes-kernel/linux/linux-hierofalcon_4.1.bb @@ -39,6 +39,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-4.1;branch="standard/qemuarm64 file://Btrfs-CVE-2015-8374.patch \ file://ALSA-CVE-2016-2384.patch \ file://net-ppp-CVE-2015-8569.patch \ + file://IB-CVE-2016-4565.patch \ " S = "${WORKDIR}/git" -- cgit v1.2.3-54-g00ecf