iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proc: Check /proc/$pid/attr/ writes against file opener

Browse Source 
commit bfb819ea20 upstream.

Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
files need to check the opener credentials, since these fds do not
transition state across execve(). Without this, it is possible to
trick another process (which may have different credentials) to write
to its own /proc/$pid/attr/ files, leading to unexpected and possibly
exploitable behaviors.

[1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Kees Cook
2021-05-25 12:37:35 -07:00
committed by Greg Kroah-Hartman
parent 7f4d9d2f0b
commit 60d171c477
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
fs/proc/base.c
View File

@@ -2556,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
void *page; void *page;
int rv; int rv;
/* A task may only write when it was the opener. */
if (file->f_cred != current_real_cred())
return -EPERM;
rcu_read_lock(); rcu_read_lock();
task = pid_task(proc_pid(inode), PIDTYPE_PID); task = pid_task(proc_pid(inode), PIDTYPE_PID);
if (!task) { if (!task) {