Home Home > GIT Browse > SLE15-SP2
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBen Hutchings <ben@decadent.org.uk>2017-04-01 04:55:18 +0100
committerBen Hutchings <ben@decadent.org.uk>2017-04-04 22:18:33 +0100
commite2b41f761b086da2ec43b1cfea14ca0681cd08b0 (patch)
tree37a41463c8c8f9420ffa57beb5acc6e8dfa9e3a8
parent2147a17048314f069838aace1d08b8c719448b50 (diff)
keys: Guard against null match function in keyring_search_aux()
The "dead" key type has no match operation, and a search for keys of this type can cause a null dereference in keyring_search_aux(). keyring_search() has a check for this, but request_keyring_and_link() does not. Move the check into keyring_search_aux(), covering both of them. This was fixed upstream by commit c06cfb08b88d ("KEYS: Remove key_type::match in favour of overriding default by match_preparse"), part of a series of large changes that are not suitable for backporting. CVE-2017-2647 / CVE-2017-6951 Reported-by: Igor Redko <redkoi@virtuozzo.com> Reported-by: Andrey Ryabinin <aryabinin@virtuozzo.com> References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2647 Reported-by: idl3r <idler1984@gmail.com> References: https://www.spinics.net/lists/keyrings/msg01845.html Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Cc: David Howells <dhowells@redhat.com>
-rw-r--r--security/keys/keyring.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 37a7f3b28852..8f31d5f6cda5 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -336,6 +336,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
if (keyring->type != &key_type_keyring)
goto error;
+ if (!match)
+ return ERR_PTR(-ENOKEY);
+
rcu_read_lock();
now = current_kernel_time();
@@ -484,9 +487,6 @@ key_ref_t keyring_search(key_ref_t keyring,
struct key_type *type,
const char *description)
{
- if (!type->match)
- return ERR_PTR(-ENOKEY);
-
return keyring_search_aux(keyring, current->cred,
type, description, type->match, false);
}