Stack overflow via ecryptfs and /proc/$pid/environ (CVE-2016-1583)
proc: prevent stacking filesystems on top ecryptfs: forbid opening files without mmap handler sched: panic on corrupted stack end
This commit is contained in:
Salvatore Bonaccorso
parent
2622600fec
commit
91d6f22ed8
|
|
@ -117,6 +117,12 @@ linux (4.6.2-1) UNRELEASED; urgency=medium
|
|||
[ Ben Hutchings ]
|
||||
* [armel,armhf,sh4] linux-image: Do not suggest fdutils
|
||||
|
||||
[ Salvatore Bonaccorso ]
|
||||
* Stack overflow via ecryptfs and /proc/$pid/environ (CVE-2016-1583)
|
||||
- proc: prevent stacking filesystems on top
|
||||
- ecryptfs: forbid opening files without mmap handler
|
||||
- sched: panic on corrupted stack end
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Thu, 09 Jun 2016 02:56:01 +0100
|
||||
|
||||
linux (4.6.1-1) unstable; urgency=medium
|
||||
|
|
|
|||
59
debian/patches/bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
vendored
Normal file
59
debian/patches/bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
vendored
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:06 +0200
|
||||
Subject: [2/3] ecryptfs: forbid opening files without mmap handler
|
||||
Origin: https://git.kernel.org/linus/2f36db71009304b3f0b95afacd8eba1f9f046b87
|
||||
|
||||
This prevents users from triggering a stack overflow through a recursive
|
||||
invocation of pagefault handling that involves mapping procfs files into
|
||||
virtual memory.
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Acked-by: Tyler Hicks <tyhicks@canonical.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/ecryptfs/kthread.c | 13 +++++++++++--
|
||||
1 file changed, 11 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
|
||||
index 866bb18..e818f5a 100644
|
||||
--- a/fs/ecryptfs/kthread.c
|
||||
+++ b/fs/ecryptfs/kthread.c
|
||||
@@ -25,6 +25,7 @@
|
||||
#include <linux/slab.h>
|
||||
#include <linux/wait.h>
|
||||
#include <linux/mount.h>
|
||||
+#include <linux/file.h>
|
||||
#include "ecryptfs_kernel.h"
|
||||
|
||||
struct ecryptfs_open_req {
|
||||
@@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
|
||||
flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
|
||||
(*lower_file) = dentry_open(&req.path, flags, cred);
|
||||
if (!IS_ERR(*lower_file))
|
||||
- goto out;
|
||||
+ goto have_file;
|
||||
if ((flags & O_ACCMODE) == O_RDONLY) {
|
||||
rc = PTR_ERR((*lower_file));
|
||||
goto out;
|
||||
@@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file **lower_file,
|
||||
mutex_unlock(&ecryptfs_kthread_ctl.mux);
|
||||
wake_up(&ecryptfs_kthread_ctl.wait);
|
||||
wait_for_completion(&req.done);
|
||||
- if (IS_ERR(*lower_file))
|
||||
+ if (IS_ERR(*lower_file)) {
|
||||
rc = PTR_ERR(*lower_file);
|
||||
+ goto out;
|
||||
+ }
|
||||
+have_file:
|
||||
+ if ((*lower_file)->f_op->mmap == NULL) {
|
||||
+ fput(*lower_file);
|
||||
+ *lower_file = NULL;
|
||||
+ rc = -EMEDIUMTYPE;
|
||||
+ }
|
||||
out:
|
||||
return rc;
|
||||
}
|
||||
--
|
||||
2.8.1
|
||||
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:05 +0200
|
||||
Subject: [1/3] proc: prevent stacking filesystems on top
|
||||
Origin: https://git.kernel.org/linus/e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9
|
||||
|
||||
This prevents stacking filesystems (ecryptfs and overlayfs) from using
|
||||
procfs as lower filesystem. There is too much magic going on inside
|
||||
procfs, and there is no good reason to stack stuff on top of procfs.
|
||||
|
||||
(For example, procfs does access checks in VFS open handlers, and
|
||||
ecryptfs by design calls open handlers from a kernel thread that doesn't
|
||||
drop privileges or so.)
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/proc/root.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/fs/proc/root.c b/fs/proc/root.c
|
||||
index 361ab4e..ec649c9 100644
|
||||
--- a/fs/proc/root.c
|
||||
+++ b/fs/proc/root.c
|
||||
@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
|
||||
if (IS_ERR(sb))
|
||||
return ERR_CAST(sb);
|
||||
|
||||
+ /*
|
||||
+ * procfs isn't actually a stacking filesystem; however, there is
|
||||
+ * too much magic going on inside it to permit stacking things on
|
||||
+ * top of it
|
||||
+ */
|
||||
+ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
|
||||
+
|
||||
if (!proc_parse_options(options, ns)) {
|
||||
deactivate_locked_super(sb);
|
||||
return ERR_PTR(-EINVAL);
|
||||
--
|
||||
2.8.1
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:07 +0200
|
||||
Subject: [3/3] sched: panic on corrupted stack end
|
||||
Origin: https://git.kernel.org/linus/29d6455178a09e1dc340380c582b13356227e8df
|
||||
|
||||
Until now, hitting this BUG_ON caused a recursive oops (because oops
|
||||
handling involves do_exit(), which calls into the scheduler, which in
|
||||
turn raises an oops), which caused stuff below the stack to be
|
||||
overwritten until a panic happened (e.g. via an oops in interrupt
|
||||
context, caused by the overwritten CPU index in the thread_info).
|
||||
|
||||
Just panic directly.
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
kernel/sched/core.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
|
||||
index d1f7149..11546a6 100644
|
||||
--- a/kernel/sched/core.c
|
||||
+++ b/kernel/sched/core.c
|
||||
@@ -3047,7 +3047,8 @@ static noinline void __schedule_bug(struct task_struct *prev)
|
||||
static inline void schedule_debug(struct task_struct *prev)
|
||||
{
|
||||
#ifdef CONFIG_SCHED_STACK_END_CHECK
|
||||
- BUG_ON(task_stack_end_corrupted(prev));
|
||||
+ if (task_stack_end_corrupted(prev))
|
||||
+ panic("corrupted stack end detected inside scheduler\n");
|
||||
#endif
|
||||
|
||||
if (unlikely(in_atomic_preempt_off())) {
|
||||
--
|
||||
2.8.1
|
||||
|
||||
|
|
@ -107,6 +107,9 @@ bugfix/all/usb-usbfs-fix-potential-infoleak-in-devio.patch
|
|||
bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch
|
||||
bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_cca.patch
|
||||
bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_tin.patch
|
||||
bugfix/all/proc-prevent-stacking-filesystems-on-top.patch
|
||||
bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
|
||||
bugfix/all/sched-panic-on-corrupted-stack-end.patch
|
||||
|
||||
# Tools bug fixes
|
||||
bugfix/all/usbip-document-tcp-wrappers.patch
|
||||
|
|
|
|||
Loading…
Reference in New Issue