From 30d6fe82d3b4abd951d9d3d2e9cd3a36c9a64927 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Mon, 7 Jun 2021 02:00:39 +0000 Subject: [PATCH] proc: Check /proc/$pid/attr/ writes against file opener stable inclusion from stable-5.10.42 commit fb003a1bd60358c0ccee0145079de258a6cf0ba8 bugzilla: 55093 CVE: NA -------------------------------- commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream. Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/ files need to check the opener credentials, since these fds do not transition state across execve(). Without this, it is possible to trick another process (which may have different credentials) to write to its own /proc/$pid/attr/ files, leading to unexpected and possibly exploitable behaviors. [1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chen Jun Acked-by: Weilong Chen Signed-off-by: Zheng Zengkai --- fs/proc/base.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5e0406eb975e..720e2e524cb1 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2720,6 +2720,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, void *page; int rv; + /* A task may only write when it was the opener. */ + if (file->f_cred != current_real_cred()) + return -EPERM; + rcu_read_lock(); task = pid_task(proc_pid(inode), PIDTYPE_PID); if (!task) { -- GitLab