linux-kernel - [PATCH] copy_process: fix CLONE_PARENT && parent_exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090302212256.GA19262@redhat.com>
Date:	Mon, 2 Mar 2009 22:22:56 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Roland McGrath <roland@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Chris Evans <scarybeasts@...il.com>,
	David Howells <dhowells@...hat.com>,
	Don Howard <dhoward@...hat.com>,
	Eugene Teo <eugene@...hat.com>,
	Michael Kerrisk <mtk.manpages@...glemail.com>,
	Tavis Ormandy <taviso@....lonestar.org>,
	Vitaly Mayatskikh <vmayatsk@...hat.com>, stable@...nel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] copy_process: fix CLONE_PARENT && parent_exec_id
	interaction

On 02/26, Oleg Nesterov wrote:
>
> I sent another patch, perhaps someone can comment. Or suggest something
> else.

Nobody commented ;)

I am re-sending this patch simplified to one-liner. If this patch is
accepted, I think it makes sense to move the first
"p->parent_exec_id = p->self_exec_id" in copy_process() down, under
the "else" branch. Just for readability.

Note! This patch doesn't even try to address the original CVE. Let me
repeat, I am not the security expert, please correct me. But, unless
parent or child change security context (via exec), it is OK to send
any ->exit_signal when the child exits.

Comments?

----------------------------------------------------------------------
[PATCH] copy_process: fix CLONE_PARENT && parent_exec_id interaction

CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we
re-use the old parent, we must also re-use ->parent_exec_id to make
sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed
task exits.

Signed-off-by: Oleg Nesterov <oleg@...hat.com>

--- 6.29-rc3/kernel/fork.c~3_CLONE_PARENT	2009-03-02 20:24:59.000000000 +0100
+++ 6.29-rc3/kernel/fork.c	2009-03-02 21:45:45.000000000 +0100
@@ -1218,9 +1218,10 @@ static struct task_struct *copy_process(
 		set_task_cpu(p, smp_processor_id());
 
 	/* CLONE_PARENT re-uses the old parent */
-	if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
-	else
+		p->parent_exec_id = current->parent_exec_id;
+	} else
 		p->real_parent = current;
 
 	spin_lock(&current->sighand->siglock);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/