WSL2-Linux-Kernel/security/keys
Dan Carpenter 38327424b4 KEYS: potential uninitialized variable
If __key_link_begin() failed then "edit" would be uninitialized.  I've
added a check to fix that.

This allows a random user to crash the kernel, though it's quite
difficult to achieve.  There are three ways it can be done as the user
would have to cause an error to occur in __key_link():

 (1) Cause the kernel to run out of memory.  In practice, this is difficult
     to achieve without ENOMEM cropping up elsewhere and aborting the
     attempt.

 (2) Revoke the destination keyring between the keyring ID being looked up
     and it being tested for revocation.  In practice, this is difficult to
     time correctly because the KEYCTL_REJECT function can only be used
     from the request-key upcall process.  Further, users can only make use
     of what's in /sbin/request-key.conf, though this does including a
     rejection debugging test - which means that the destination keyring
     has to be the caller's session keyring in practice.

 (3) Have just enough key quota available to create a key, a new session
     keyring for the upcall and a link in the session keyring, but not then
     sufficient quota to create a link in the nominated destination keyring
     so that it fails with EDQUOT.

The bug can be triggered using option (3) above using something like the
following:

	echo 80 >/proc/sys/kernel/keys/root_maxbytes
	keyctl request2 user debug:fred negate @t

The above sets the quota to something much lower (80) to make the bug
easier to trigger, but this is dependent on the system.  Note also that
the name of the keyring created contains a random number that may be
between 1 and 10 characters in size, so may throw the test off by
changing the amount of quota used.

Assuming the failure occurs, something like the following will be seen:

	kfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h
	------------[ cut here ]------------
	kernel BUG at ../mm/slab.c:2821!
	...
	RIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25
	RSP: 0018:ffff8804014a7de8  EFLAGS: 00010092
	RAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000
	RDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300
	RBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000
	R10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202
	R13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001
	...
	Call Trace:
	  kfree+0xde/0x1bc
	  assoc_array_cancel_edit+0x1f/0x36
	  __key_link_end+0x55/0x63
	  key_reject_and_link+0x124/0x155
	  keyctl_reject_key+0xb6/0xe0
	  keyctl_negate_key+0x10/0x12
	  SyS_keyctl+0x9f/0xe7
	  do_syscall_64+0x63/0x13a
	  entry_SYSCALL64_slow_path+0x25/0x25

Fixes: f70e2e0619 ('KEYS: Do preallocation for __key_link()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-06-16 17:15:04 -10:00
..
encrypted-keys KEYS: Use skcipher 2016-01-27 20:36:03 +08:00
Kconfig KEYS: Add KEYCTL_DH_COMPUTE command 2016-04-12 19:54:58 +01:00
Makefile KEYS: Add KEYCTL_DH_COMPUTE command 2016-04-12 19:54:58 +01:00
big_key.c Security: Keys: Big keys stored encrypted 2016-04-12 19:54:58 +01:00
compat.c KEYS: Add placeholder for KDF usage with DH 2016-06-03 16:14:34 +10:00
dh.c KEYS: Add placeholder for KDF usage with DH 2016-06-03 16:14:34 +10:00
gc.c KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring 2015-10-15 17:21:37 +01:00
internal.h KEYS: Add placeholder for KDF usage with DH 2016-06-03 16:14:34 +10:00
key.c KEYS: potential uninitialized variable 2016-06-16 17:15:04 -10:00
keyctl.c KEYS: Add placeholder for KDF usage with DH 2016-06-03 16:14:34 +10:00
keyring.c KEYS: Remove KEY_FLAG_TRUSTED and KEY_ALLOC_TRUSTED 2016-04-11 22:44:15 +01:00
permission.c KEYS: Move the flags representing required permission to linux/key.h 2014-03-14 17:44:49 +00:00
persistent.c KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
proc.c KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y 2015-01-22 22:34:32 +00:00
process_keys.c KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
request_key.c KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
request_key_auth.c KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
sysctl.c security: Convert use of typedef ctl_table to struct ctl_table 2014-04-15 13:39:58 +10:00
trusted.c tpm: fix checks for policy digest existence in tpm2_seal_trusted() 2016-02-10 04:10:55 +02:00
trusted.h keys, trusted: move struct trusted_key_options to trusted-type.h 2015-10-19 01:01:21 +02:00
user_defined.c KEYS: user_update should use copy of payload made during preparsing 2016-04-12 19:54:58 +01:00