lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

net: Fix ns_capable check in sock_diag_put_filterinfo

Browse Source 
The caller needs capabilities on the namespace being queried, not on
their own namespace.  This is a security bug, although it likely has
only a minor impact.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Andrew Lutomirski
2014-04-16 21:41:34 -07:00
committed by David S. Miller
parent b0bda38532
commit 78541c1dc6
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/sock_diag.h
View File

@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);
void sock_diag_save_cookie(void *sk, __u32 *cookie); void sock_diag_save_cookie(void *sk, __u32 *cookie);
int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr); int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, int sock_diag_put_filterinfo(struct sock *sk,
struct sk_buff *skb, int attrtype); struct sk_buff *skb, int attrtype);
#endif #endif

4
net/core/sock_diag.c
View File

@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype)
} }
EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, int sock_diag_put_filterinfo(struct sock *sk,
struct sk_buff *skb, int attrtype) struct sk_buff *skb, int attrtype)
{ {
struct sock_fprog_kern *fprog; struct sock_fprog_kern *fprog;
@@ -58,7 +58,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
unsigned int flen; unsigned int flen;
int err = 0; int err = 0;
if (!ns_capable(user_ns, CAP_NET_ADMIN)) { if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
nla_reserve(skb, attrtype, 0); nla_reserve(skb, attrtype, 0);
return 0; return 0;
} }

2
net/packet/diag.c
View File

@@ -172,7 +172,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
goto out_nlmsg_trim; goto out_nlmsg_trim;
if ((req->pdiag_show & PACKET_SHOW_FILTER) && if ((req->pdiag_show & PACKET_SHOW_FILTER) &&
sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER)) sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER))
goto out_nlmsg_trim; goto out_nlmsg_trim;
return nlmsg_end(skb, nlh); return nlmsg_end(skb, nlh);