From: Ben Hutchings Date: Sat, 1 Apr 2017 03:55:18 +0000 (+0100) Subject: keys: Guard against null match function in keyring_search_aux() X-Git-Tag: v3.2.88~1 X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-kernel.git;a=commitdiff_plain;h=e2b41f761b086da2ec43b1cfea14ca0681cd08b0 keys: Guard against null match function in keyring_search_aux() The "dead" key type has no match operation, and a search for keys of this type can cause a null dereference in keyring_search_aux(). keyring_search() has a check for this, but request_keyring_and_link() does not. Move the check into keyring_search_aux(), covering both of them. This was fixed upstream by commit c06cfb08b88d ("KEYS: Remove key_type::match in favour of overriding default by match_preparse"), part of a series of large changes that are not suitable for backporting. CVE-2017-2647 / CVE-2017-6951 Reported-by: Igor Redko Reported-by: Andrey Ryabinin References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2647 Reported-by: idl3r References: https://www.spinics.net/lists/keyrings/msg01845.html Signed-off-by: Ben Hutchings Cc: David Howells --- diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 37a7f3b28852..8f31d5f6cda5 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -336,6 +336,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, if (keyring->type != &key_type_keyring) goto error; + if (!match) + return ERR_PTR(-ENOKEY); + rcu_read_lock(); now = current_kernel_time(); @@ -484,9 +487,6 @@ key_ref_t keyring_search(key_ref_t keyring, struct key_type *type, const char *description) { - if (!type->match) - return ERR_PTR(-ENOKEY); - return keyring_search_aux(keyring, current->cred, type, description, type->match, false); }