diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2017-04-01 04:55:18 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-04-04 22:18:33 +0100 |
| commit | e2b41f761b086da2ec43b1cfea14ca0681cd08b0 (patch) | |
| tree | 37a41463c8c8f9420ffa57beb5acc6e8dfa9e3a8 | |
| parent | 2147a17048314f069838aace1d08b8c719448b50 (diff) | |
keys: Guard against null match function in keyring_search_aux()
The "dead" key type has no match operation, and a search for keys of
this type can cause a null dereference in keyring_search_aux().
keyring_search() has a check for this, but request_keyring_and_link()
does not. Move the check into keyring_search_aux(), covering both of
them.
This was fixed upstream by commit c06cfb08b88d ("KEYS: Remove
key_type::match in favour of overriding default by match_preparse"),
part of a series of large changes that are not suitable for
backporting.
CVE-2017-2647 / CVE-2017-6951
Reported-by: Igor Redko <redkoi@virtuozzo.com>
Reported-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2647
Reported-by: idl3r <idler1984@gmail.com>
References: https://www.spinics.net/lists/keyrings/msg01845.html
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: David Howells <dhowells@redhat.com>
| -rw-r--r-- | security/keys/keyring.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 37a7f3b28852..8f31d5f6cda5 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -336,6 +336,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, if (keyring->type != &key_type_keyring) goto error; + if (!match) + return ERR_PTR(-ENOKEY); + rcu_read_lock(); now = current_kernel_time(); @@ -484,9 +487,6 @@ key_ref_t keyring_search(key_ref_t keyring, struct key_type *type, const char *description) { - if (!type->match) - return ERR_PTR(-ENOKEY); - return keyring_search_aux(keyring, current->cred, type, description, type->match, false); } |