Eric W. Biederman
110012a2c9
signal: Extend exec_id to 64bits ...
commit d1e7fd6462ca9fc76650fbe6ca800e35b24267da upstream.
Replace the 32bit exec_id with a 64bit exec_id to make it impossible
to wrap the exec_id counter. With care an attacker can cause exec_id
wrap and send arbitrary signals to a newly exec'd parent. This
bypasses the signal sending checks if the parent changes their
credentials during exec.
The severity of this problem can been seen that in my limited testing
of a 32bit exec_id it can take as little as 19s to exec 65536 times.
Which means that it can take as little as 14 days to wrap a 32bit
exec_id. Adam Zabrocki has succeeded wrapping the self_exe_id in 7
days. Even my slower timing is in the uptime of a typical server.
Which means self_exec_id is simply a speed bump today, and if exec
gets noticably faster self_exec_id won't even be a speed bump.
Extending self_exec_id to 64bits introduces a problem on 32bit
architectures where reading self_exec_id is no longer atomic and can
take two read instructions. Which means that is is possible to hit
a window where the read value of exec_id does not match the written
value. So with very lucky timing after this change this still
remains expoiltable.
I have updated the update of exec_id on exec to use WRITE_ONCE
and the read of exec_id in do_notify_parent to use READ_ONCE
to make it clear that there is no locking between these two
locations.
Link: https://lore.kernel.org/kernel-hardening/20200324215049.GA3710@pi3.com.pl
Fixes: 2.3.23pre2
Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-24 07:58:54 +02:00
bpf: Explicitly memset the bpf_attr structure
2020-04-02 17:20:40 +02:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kdb: do a sanity check on the cpu in kdb_per_cpu()
2020-01-29 10:24:24 +01:00
perf/core: Fix mlock accounting in perf_mmap()
2020-02-14 16:31:08 -05:00
gcov: support GCC 7.1
2017-09-02 07:07:53 +02:00
genirq: Fix reference leaks on irq affinity notifiers
2020-04-02 17:20:34 +02:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
2020-04-24 07:58:49 +02:00
PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
2020-01-12 11:24:11 +01:00
printk: fix integer overflow in setup_log_buf()
2019-11-28 18:28:15 +01:00
rcuperf: Fix cleanup path for invalid perf_type strings
2019-05-31 06:48:30 -07:00
sched: Avoid scale real weight down to zero
2020-04-24 07:58:47 +02:00
clocksource: Prevent double add_timer_on() for watchdog_timer
2020-02-14 16:31:08 -05:00
trigger_next should increase position index
2020-02-28 15:42:40 +01:00
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-10 09:29:51 +01:00
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-17 13:21:18 +01:00
audit: always check the netlink payload length in audit_receive_msg()
2020-03-11 07:53:08 +01:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
audit_get_nd(): don't unlock parent too early
2019-12-21 10:40:48 +01:00
audit: fix error handling in audit_data_to_entry()
2020-03-11 07:53:05 +01:00
audit: print empty EXECVE args
2019-11-28 18:28:55 +01:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-11-13 11:16:57 -08:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup: memcg: net: do not associate sock with unrelated cgroup
2020-03-20 09:07:43 +01:00
cgroup: pids: use atomic64_t for pids->limit
2019-12-21 10:42:02 +01:00
cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
2020-02-28 15:42:16 +01:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
memcg: account security cred as well to kmemcg
2020-01-12 11:24:13 +01:00
kernel/elfcore.c: include proper prototypes
2019-10-17 13:42:13 -07:00
kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
2019-02-06 17:33:29 +01:00
kernel/extable.c: mark core_kernel_text notrace
2017-07-21 07:42:21 +02:00
kernel/sysctl.c: do not override max_threads provided by userspace
2019-10-17 13:42:44 -07:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Unbreak futex hashing
2020-04-02 17:20:28 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
kernel: hung_task.c: disable on suspend
2019-04-20 09:07:52 +02:00
jump_label: Invoke jump_label_test() via early_initcall()
2017-12-14 09:28:24 +01:00
kcov: ensure irq code sees a valid area
2018-08-03 07:55:12 +02:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
objtool, x86: Add several functions and files to the objtool whitelist
2018-06-05 10:28:57 +02:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
2019-11-25 09:52:15 +01:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
kthread, tracing: Don't expose half-written comm when creating kthreads
2018-08-03 07:55:12 +02:00
x86/uaccess, kcov: Disable stack protector
2019-06-22 08:17:19 +02:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm, devm_memremap_pages: kill mapping "System RAM" support
2019-01-13 10:03:51 +01:00
kernel/module.c: wakeup processes in module_wq on module unload
2019-12-21 10:42:21 +01:00
x86/mm: split vmalloc_sync_all()
2020-04-02 17:20:26 +02:00
padata: always acquire cpu_hotplug_lock before pinst->lock
2020-04-13 10:32:53 +02:00
panic: ensure preemption is disabled during panic()
2019-10-17 13:42:25 -07:00
pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
2018-04-13 19:47:53 +02:00
signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
2019-08-04 09:33:16 +02:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
2019-07-10 09:55:45 +02:00
kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
2018-05-30 07:50:29 +02:00
resource: fix integer overflow at reallocation
2018-04-24 09:34:09 +02:00
seccomp: Move speculation migitation control to arch code
2018-05-22 16:58:02 +02:00
signal: Extend exec_id to 64bits
2020-04-24 07:58:54 +02:00
cpu/hotplug: Fix SMT supported evaluation
2018-08-15 18:14:53 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
Mark HI and TASKLET softirq synchronous
2018-08-15 18:14:42 +02:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
stop_machine: Use raw spinlocks
2018-08-03 07:55:24 +02:00
kernel/sys.c: prctl: fix false positive in validate_prctl_map()
2019-06-22 08:17:13 +02:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
kernel: sysctl: make drop_caches write-only
2020-01-04 13:41:04 +01:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix data-race
2020-01-12 11:24:12 +01:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
tracepoint: Do not warn on ENOMEM
2018-05-09 09:50:20 +02:00
kernel/ucount.c: mark user_header with kmemleak_ignore()
2017-06-17 06:41:51 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
userns: move user access out of the mutex
2018-09-09 20:01:24 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
sys: don't hold uts_sem while accessing userspace memory
2018-09-09 20:01:24 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
workqueue: don't use wq_select_unbound_cpu() for bound works
2020-03-20 09:07:43 +01:00
workqueue: Fix NULL pointer dereference
2017-11-15 15:53:17 +01:00
110012a2c9