Kees CookandGreg Kroah-Hartman fb003a1bd6 proc: Check /proc/$pid/attr/ writes against file opener ...

commit bfb819ea20 upstream.

Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
files need to check the opener credentials, since these fds do not
transition state across execve(). Without this, it is possible to
trick another process (which may have different credentials) to write
to its own /proc/$pid/attr/ files, leading to unexpected and possibly
exploitable behaviors.

[1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-06-03 09:00:28 +02:00

..

array.c

seccomp: Fix CONFIG tests for Seccomp_filters

2021-05-14 09:50:24 +02:00

base.c

proc: Check /proc/$pid/attr/ writes against file opener

2021-06-03 09:00:28 +02:00

bootconfig.c

proc/bootconfig: Fix to use correct quotes for value

2020-06-16 21:21:03 -04:00

cmdline.c

…

consoles.c

…

cpuinfo.c

proc/cpuinfo: switch to ->read_iter

2020-11-06 10:05:18 -08:00

devices.c

block: move block-related definitions out of fs.h

2020-06-24 09:16:02 -06:00

fd.c

…

fd.h

…

generic.c

fs/proc/generic.c: fix incorrect pde_is_permanent check

2021-05-19 10:13:09 +02:00

inode.c

proc: wire up generic_file_splice_read for iter ops

2020-11-06 10:05:18 -08:00

internal.h

proc: fix lookup in /proc/net subdirectories after setns(2)

2020-12-30 11:53:56 +01:00

interrupts.c

…

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

kcore.c

maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault

2020-06-17 10:57:41 -07:00

kmsg.c

…

loadavg.c

…

Makefile

…

meminfo.c

proc/meminfo: avoid open coded reading of vm_committed_as

2020-08-07 11:33:26 -07:00

namespaces.c

…

nommu.c

mm: don't include asm/pgtable.h if linux/mm.h is already included

2020-06-09 09:39:13 -07:00

page.c

mm: Add PG_arch_2 page flag

2020-09-04 12:46:06 +01:00

proc_net.c

proc: fix lookup in /proc/net subdirectories after setns(2)

2020-12-30 11:53:56 +01:00

proc_sysctl.c

proc: use kvzalloc for our kernel buffer

2021-03-04 11:38:21 +01:00

proc_tty.c

…

root.c

proc: s_fs_info may be NULL when proc_kill_sb is called

2020-06-10 14:54:54 -05:00

self.c

proc: don't allow async path resolution of /proc/thread-self components

2021-03-04 11:38:42 +01:00

softirqs.c

…

stat.c

proc/stat: switch to ->read_iter

2020-11-06 10:05:18 -08:00

task_mmu.c

mm: proc: Invalidate TLB after clearing soft-dirty page state

2021-03-04 11:37:45 +01:00

task_nommu.c

mmap locking API: use coccinelle to convert mmap_sem rwsem call sites

2020-06-09 09:39:14 -07:00

thread_self.c

proc: don't allow async path resolution of /proc/thread-self components

2021-03-04 11:38:42 +01:00

uptime.c

…

util.c

…

version.c

…

vmcore.c

mm: don't include asm/pgtable.h if linux/mm.h is already included

2020-06-09 09:39:13 -07:00