debian-packaging
/
linux
8
0
Fork 0
Code Releases Activity

Update to 4.9.25

This commit is contained in:
Salvatore Bonaccorso 2017-04-27 19:42:52 +02:00
parent d2be118d62
commit 4c666bd4da
4 changed files with 27 additions and 257 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
debian/changelog vendored
View File

@ -1,4 +1,4 @@
linux (4.9.24-1) UNRELEASED; urgency=medium
linux (4.9.25-1) UNRELEASED; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.19
@ -301,6 +301,32 @@ linux (4.9.24-1) UNRELEASED; urgency=medium
- dvb-usb-firmware: don't do DMA on stack (CVE-2017-8061)
- cxusb: Use a dma capable buffer also for reading (CVE-2017-8063)
- virtio-console: avoid DMA from stack (CVE-2017-8067)
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.25
- KEYS: Disallow keyrings beginning with '.' to be joined as session
keyrings (CVE-2016-9604)
- KEYS: Change the name of the dead type to ".dead" to prevent user access
(CVE-2017-6951)
- KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
(CVE-2017-7472)
- tracing: Allocate the snapshot buffer before enabling probe
- ring-buffer: Have ring_buffer_iter_empty() return true when empty
- mm: prevent NR_ISOLATE_* stats from going negative
- cifs: Do not send echoes before Negotiate is complete
- CIFS: remove bad_network_name flag
- [s390x] mm: fix CMMA vs KSM vs others
- Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled
- ACPI / power: Avoid maybe-uninitialized warning
- [armhf] mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for
DDR50 card
- ubifs: Fix RENAME_WHITEOUT support
- ubifs: Fix O_TMPFILE corner case in ubifs_link()
- mac80211: reject ToDS broadcast data frames
- mac80211: fix MU-MIMO follow-MAC mode
- ubi/upd: Always flush after prepared for an update
- [powerpc*] kprobe: Fix oops when kprobed on 'stdu' instruction
- [x86] mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs
- [x86] mce: Make the MCE notifier a blocking one
- device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation
[ Ben Hutchings ]
* w1: Really enable W1_MASTER_GPIO as module (Closes: #858975)
@ -328,10 +354,6 @@ linux (4.9.24-1) UNRELEASED; urgency=medium
- rtmutex: Provide rt_mutex_lock_state()
- rtmutex: Provide locked slowpath
- rwsem/rt: Lift single reader restriction
* KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
(CVE-2016-9604)
* KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
(CVE-2017-7472)
* PCI: Enable PCIE_PTM (except on armel/marvell)
* 6lowpan: Enable Generic Header Compression modules
* net/sched: Enable NET_ACT_SKBMOD as module

76
debian/patches/bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch vendored
View File

@ -1,76 +0,0 @@
From: David Howells <dhowells@redhat.com>
Date: Tue, 18 Apr 2017 15:31:07 +0100
Subject: KEYS: Disallow keyrings beginning with '.' to be joined as session
keyrings
Origin: https://git.kernel.org/linus/ee8f844e3c5a73b999edf733df1c529d6503ec2f
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-9604
This fixes CVE-2016-9604.
Keyrings whose name begin with a '.' are special internal keyrings and so
userspace isn't allowed to create keyrings by this name to prevent
shadowing. However, the patch that added the guard didn't fix
KEYCTL_JOIN_SESSION_KEYRING. Not only can that create dot-named keyrings,
it can also subscribe to them as a session keyring if they grant SEARCH
permission to the user.
This, for example, allows a root process to set .builtin_trusted_keys as
its session keyring, at which point it has full access because now the
possessor permissions are added. This permits root to add extra public
keys, thereby bypassing module verification.
This also affects kexec and IMA.
This can be tested by (as root):
keyctl session .builtin_trusted_keys
keyctl add user a a @s
keyctl list @s
which on my test box gives me:
2 keys in keyring:
180010936: ---lswrv 0 0 asymmetric: Build time autogenerated kernel key: ae3d4a31b82daa8e1a75b49dc2bba949fd992a05
801382539: --alswrv 0 0 user: a
Fix this by rejecting names beginning with a '.' in the keyctl.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
cc: linux-ima-devel@lists.sourceforge.net
cc: stable@vger.kernel.org
---
security/keys/keyctl.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -271,7 +271,8 @@ error:
* Create and join an anonymous session keyring or join a named session
* keyring, creating it if necessary. A named session keyring must have Search
* permission for it to be joined. Session keyrings without this permit will
- * be skipped over.
+ * be skipped over. It is not permitted for userspace to create or join
+ * keyrings whose name begin with a dot.
*
* If successful, the ID of the joined session keyring will be returned.
*/
@@ -288,12 +289,16 @@ long keyctl_join_session_keyring(const c
ret = PTR_ERR(name);
goto error;
}
+
+ ret = -EPERM;
+ if (name[0] == '.')
+ goto error_name;
}
/* join the session */
ret = join_session_keyring(name);
+error_name:
kfree(name);
-
error:
return ret;
}

174
debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch vendored
View File

@ -1,174 +0,0 @@
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 18 Apr 2017 15:31:09 +0100
Subject: KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
Origin: https://git.kernel.org/linus/c9f838d104fed6f2f61d68164712e3204bf5271b
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7472
This fixes CVE-2017-7472.
Running the following program as an unprivileged user exhausts kernel
memory by leaking thread keyrings:
#include <keyutils.h>
int main()
{
for (;;)
keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
}
Fix it by only creating a new thread keyring if there wasn't one before.
To make things more consistent, make install_thread_keyring_to_cred()
and install_process_keyring_to_cred() both return 0 if the corresponding
keyring is already present.
Fixes: d84f4f992cbd ("CRED: Inaugurate COW credentials")
Cc: stable@vger.kernel.org # 2.6.29+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
security/keys/keyctl.c | 11 ++++-------
security/keys/process_keys.c | 44 +++++++++++++++++++++++++++-----------------
2 files changed, 31 insertions(+), 24 deletions(-)
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1256,8 +1256,8 @@ error:
* Read or set the default keyring in which request_key() will cache keys and
* return the old setting.
*
- * If a process keyring is specified then this will be created if it doesn't
- * yet exist. The old setting will be returned if successful.
+ * If a thread or process keyring is specified then it will be created if it
+ * doesn't yet exist. The old setting will be returned if successful.
*/
long keyctl_set_reqkey_keyring(int reqkey_defl)
{
@@ -1282,11 +1282,8 @@ long keyctl_set_reqkey_keyring(int reqke
case KEY_REQKEY_DEFL_PROCESS_KEYRING:
ret = install_process_keyring_to_cred(new);
- if (ret < 0) {
- if (ret != -EEXIST)
- goto error;
- ret = 0;
- }
+ if (ret < 0)
+ goto error;
goto set;
case KEY_REQKEY_DEFL_DEFAULT:
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -127,13 +127,18 @@ error:
}
/*
- * Install a fresh thread keyring directly to new credentials. This keyring is
- * allowed to overrun the quota.
+ * Install a thread keyring to the given credentials struct if it didn't have
+ * one already. This is allowed to overrun the quota.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
*/
int install_thread_keyring_to_cred(struct cred *new)
{
struct key *keyring;
+ if (new->thread_keyring)
+ return 0;
+
keyring = keyring_alloc("_tid", new->uid, new->gid, new,
KEY_POS_ALL | KEY_USR_VIEW,
KEY_ALLOC_QUOTA_OVERRUN,
@@ -146,7 +151,9 @@ int install_thread_keyring_to_cred(struc
}
/*
- * Install a fresh thread keyring, discarding the old one.
+ * Install a thread keyring to the current task if it didn't have one already.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
*/
static int install_thread_keyring(void)
{
@@ -157,8 +164,6 @@ static int install_thread_keyring(void)
if (!new)
return -ENOMEM;
- BUG_ON(new->thread_keyring);
-
ret = install_thread_keyring_to_cred(new);
if (ret < 0) {
abort_creds(new);
@@ -169,17 +174,17 @@ static int install_thread_keyring(void)
}
/*
- * Install a process keyring directly to a credentials struct.
+ * Install a process keyring to the given credentials struct if it didn't have
+ * one already. This is allowed to overrun the quota.
*
- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
- * and other value on any other error
+ * Return: 0 if a process keyring is now present; -errno on failure.
*/
int install_process_keyring_to_cred(struct cred *new)
{
struct key *keyring;
if (new->process_keyring)
- return -EEXIST;
+ return 0;
keyring = keyring_alloc("_pid", new->uid, new->gid, new,
KEY_POS_ALL | KEY_USR_VIEW,
@@ -193,11 +198,9 @@ int install_process_keyring_to_cred(stru
}
/*
- * Make sure a process keyring is installed for the current process. The
- * existing process keyring is not replaced.
+ * Install a process keyring to the current task if it didn't have one already.
*
- * Returns 0 if there is a process keyring by the end of this function, some
- * error otherwise.
+ * Return: 0 if a process keyring is now present; -errno on failure.
*/
static int install_process_keyring(void)
{
@@ -211,14 +214,18 @@ static int install_process_keyring(void)
ret = install_process_keyring_to_cred(new);
if (ret < 0) {
abort_creds(new);
- return ret != -EEXIST ? ret : 0;
+ return ret;
}
return commit_creds(new);
}
/*
- * Install a session keyring directly to a credentials struct.
+ * Install the given keyring as the session keyring of the given credentials
+ * struct, replacing the existing one if any. If the given keyring is NULL,
+ * then install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
*/
int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
{
@@ -253,8 +260,11 @@ int install_session_keyring_to_cred(stru
}
/*
- * Install a session keyring, discarding the old one. If a keyring is not
- * supplied, an empty one is invented.
+ * Install the given keyring as the session keyring of the current task,
+ * replacing the existing one if any. If the given keyring is NULL, then
+ * install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
*/
static int install_session_keyring(struct key *keyring)
{

2
debian/patches/series vendored
View File

@ -108,8 +108,6 @@ debian/time-mark-timer_stats-as-broken.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_frame_nr.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_reserve.patch
bugfix/all/ping-implement-proper-locking.patch
bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch
bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
bugfix/all/macsec-avoid-heap-overflow-in-skb_to_sgvec.patch
bugfix/all/macsec-dynamically-allocate-space-for-sglist.patch