Date: Tue, 8 Dec 2015 20:32:03 -0500 (EST) From: Wade Mealing <wmealing@...hat.com> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE request - Linux kernel - Fix handling of stored error in a negatively instantiated user key Gday, A bug was found by Dmitry Vyukov (of Google engineering) in the Linux kernel key management code. A malicious user with a local account may be able to escalate privileges and take control of local system by abusing the user key subsystem. >From the patch: -- If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively instantiated by updating it with valid data. However, the ->update key type method must be aware that the error code may be there. -- The paging address is predictable and mappable as userspace memory and can be used by abused by an attacker to escalate privileges. This is not the same issue as CVE-2015-7872, this issue persists after the fix is applied. I have only seen this affected on the 4.4 release candidates. Thanks, Wade Mealing Upstream fix ------------ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096fe9eaea40a17e125569f9e657e34cdb6d73bd Red Hat Bugzilla: - https://bugzilla.redhat.com/show_bug.cgi?id=1284450
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.