From patchwork Mon May 31 13:13:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 451293 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8106C47082 for ; Mon, 31 May 2021 13:23:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CB5F5613EB for ; Mon, 31 May 2021 13:23:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231952AbhEaNZe (ORCPT ); Mon, 31 May 2021 09:25:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:54850 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232023AbhEaNX3 (ORCPT ); Mon, 31 May 2021 09:23:29 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 566636108D; Mon, 31 May 2021 13:19:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1622467199; bh=N2/kFzxbkVvTsF9N8fTSf6aT6iuKAiyLrkMeEZNFbgE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p0CY5HSM58UZHVK9mOnufajxUBAgUW7QlGJ4q2NNciA2kOsMl32vksRic8qidKtSw ktbf3WUNwqopeEhuLmmLgrEaCQKRx0mBvgifx0tHZKrURN0HsTCL5XCxcYEJsnCWkW EOgnGWiNgnnzeSd8djra3vJlt7b9y0qi1WFVPzlE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Linus Torvalds Subject: [PATCH 4.9 07/66] proc: Check /proc/$pid/attr/ writes against file opener Date: Mon, 31 May 2021 15:13:40 +0200 Message-Id: <20210531130636.500666511@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210531130636.254683895@linuxfoundation.org> References: <20210531130636.254683895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kees Cook commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream. Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/ files need to check the opener credentials, since these fds do not transition state across execve(). Without this, it is possible to trick another process (which may have different credentials) to write to its own /proc/$pid/attr/ files, leading to unexpected and possibly exploitable behaviors. [1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/proc/base.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2522,6 +2522,10 @@ static ssize_t proc_pid_attr_write(struc ssize_t length; struct task_struct *task = get_proc_task(inode); + /* A task may only write when it was the opener. */ + if (file->f_cred != current_real_cred()) + return -EPERM; + length = -ESRCH; if (!task) goto out_no_task;