• Ryan Mallon's avatar
    vsprintf: check real user/group id for %pK · 312b4e22
    Ryan Mallon authored
    Some setuid binaries will allow reading of files which have read
    permission by the real user id.  This is problematic with files which
    use %pK because the file access permission is checked at open() time,
    but the kptr_restrict setting is checked at read() time.  If a setuid
    binary opens a %pK file as an unprivileged user, and then elevates
    permissions before reading the file, then kernel pointer values may be
    This happens for example with the setuid pppd application on Ubuntu 12.04:
      $ head -1 /proc/kallsyms
      00000000 T startup_32
      $ pppd file /proc/kallsyms
      pppd: In file /proc/kallsyms: unrecognized option 'c1000000'
    This will only leak the pointer value from the first line, but other
    setuid binaries may leak more information.
    Fix this by adding a check that in addition to the current process having
    CAP_SYSLOG, that effective user and group ids are equal to the real ids.
    If a setuid binary reads the contents of a file which uses %pK then the
    pointer values will be printed as NULL if the real user is unprivileged.
    Update the sysctl documentation to reflect the changes, and also correct
    the documentation to state the kptr_restrict=0 is the default.
    This is a only temporary solution to the issue.  The correct solution is
    to do the permission check at open() time on files, and to replace %pK
    with a function which checks the open() time permission.  %pK uses in
    printk should be removed since no sane permission check can be done, and
    instead protected by using dmesg_restrict.
    Signed-off-by: default avatarRyan Mallon <rmallon@gmail.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Joe Perches <joe@perches.com>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
kernel.txt 27.3 KB