[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024070208-legume-possible-de8b@gregkh>
Date: Tue, 2 Jul 2024 21:19:33 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Michal Koutný <mkoutny@...e.com>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org,
linux-cve-announce@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: CVE-2021-47285: net/nfc/rawsock.c: fix a permission check bug
On Tue, Jul 02, 2024 at 06:15:09PM +0200, Michal Koutný wrote:
> Hello.
>
> On Tue, May 21, 2024 at 04:20:39PM GMT, Greg Kroah-Hartman <gregkh@...uxfoundation.org> wrote:
> > In the Linux kernel, the following vulnerability has been resolved:
> >
> > net/nfc/rawsock.c: fix a permission check bug
> >
> > The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().
> >
> > The Linux kernel CVE team has assigned CVE-2021-47285 to this issue.
> > ...
> > https://git.kernel.org/stable/c/8ab78863e9eff11910e1ac8bcf478060c29b379e
>
> Despite the patch changes guard related to EPERM bailout, it actually
> swaps a "stronger" predicate capable() for a "weaker" ns_capable().
>
> Without the patch, an unprivilged user is not allowed to create nfc
> SOCK_RAW inside owned netns, with the patch, it's allowed.
Ah, we misread this, thinking it went up in security, not "down".
And this was from the old GSD ids, odd that no one noticed it then :(
Anyway, now rejected, thanks for the review!
greg k-h
Powered by blists - more mailing lists