From 5494bd6a500cc7c5a502279eabfbdacccd4b89d1 Mon Sep 17 00:00:00 2001 From: David Howells Date: Mon, 10 Apr 2006 17:01:40 +0000 Subject: [PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522] This fixes the problem of an oops occuring when a user attempts to add a key to a non-keyring key [CVE-2006-1522]. The problem is that __keyring_search_one() doesn't check that the keyring it's been given is actually a keyring. I've fixed this problem by: (1) declaring that caller of __keyring_search_one() must guarantee that the keyring is a keyring; and (2) making key_create_or_update() check that the keyring is a keyring, and return -ENOTDIR if it isn't. This can be tested by: keyctl add user b b `keyctl add user a a @s` Signed-off-by: David Howells Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- security/keys/key.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'security/keys/key.c') diff --git a/security/keys/key.c b/security/keys/key.c index 99781b798312..0e2584e11308 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, key_check(keyring); + key_ref = ERR_PTR(-ENOTDIR); + if (keyring->type != &key_type_keyring) + goto error_2; + down_write(&keyring->sem); /* if we're going to allocate a new key, we're going to have -- cgit v1.2.3