oss-security - CVE-2009-1883 kernel: missing capability check in z90crypt

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Sep 2009 09:14:13 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE-2009-1883 kernel: missing capability check in z90crypt

There is a missing capability check in the z90crypt driver in the Linux 
kernel. This missing check could allow a local, unprivileged user to 
bypass intended capability restrictions. Thanks to Solar Designer for 
reporting this issue to us.

Note that this does not affect upstream anymore.

@@ -1887,20 +1887,21 @@ z90crypt_unlocked_ioctl(struct file *fil
      PRINTK("No longer issuing messages about depre"
             "cated ioctl Z90STAT_PCIXCCCOUNT.\n");
    }

    tempstat = get_status_PCIXCCcount();
    if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
     ret = -EFAULT;
    break;

   case Z90QUIESCE:
    if (current->euid != 0) { <-- should check a capability
     PRINTK("QUIESCE fails: euid %d\n",
            current->euid);
     ret = -EACCES;
    } else {
     PRINTK("QUIESCE device from PID %d\n", PID());
     quiesce_z90crypt = 1;
    }
    break;

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.