From 7e5b8f0a11dbc0d5c41327930701859b6d591f54 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Wed, 30 Jun 2021 21:04:15 +0800 Subject: [PATCH] proc: Check /proc/$pid/attr/ writes against file opener stable inclusion from linux-4.19.193 commit 582a9b9813ecc89a3b5944ea412f383d02904c50 -------------------------------- commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream. Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/ files need to check the opener credentials, since these fds do not transition state across execve(). Without this, it is possible to trick another process (which may have different credentials) to write to its own /proc/$pid/attr/ files, leading to unexpected and possibly exploitable behaviors. [1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yang Yingliang --- fs/proc/base.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 32c7f7d69267..e43c1c9480cb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2564,6 +2564,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, void *page; int rv; + /* A task may only write when it was the opener. */ + if (file->f_cred != current_real_cred()) + return -EPERM; + rcu_read_lock(); task = pid_task(proc_pid(inode), PIDTYPE_PID); if (!task) { -- GitLab