linux

mirror of https://github.com/hardkernel/linux.git synced 2026-03-25 03:50:24 +09:00

Files

Eric Biggers d19182e28c KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings

commit c9f838d104 upstream.

This fixes CVE-2017-7472.

Running the following program as an unprivileged user exhausts kernel
memory by leaking thread keyrings:

	#include <keyutils.h>

	int main()
	{
		for (;;)
			keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
	}

Fix it by only creating a new thread keyring if there wasn't one before.
To make things more consistent, make install_thread_keyring_to_cred()
and install_process_keyring_to_cred() both return 0 if the corresponding
keyring is already present.

Fixes: d84f4f992c ("CRED: Inaugurate COW credentials")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-06-08 00:46:48 +02:00

encrypted-keys

KEYS: Fix stale key registration at error path

2015-01-08 09:58:16 -08:00

compat.c

Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys

2013-03-12 11:05:45 -07:00

gc.c

KEYS: Change the name of the dead type to ".dead" to prevent user access

2017-06-08 00:46:48 +02:00

internal.h

aio: don't include aio.h in sched.h