From 6e23854a2c0c6acedb76eaeb306090aaacf58245 Mon Sep 17 00:00:00 2001 From: Joe Lawrence Date: Thu, 24 Feb 2022 13:03:17 -0500 Subject: [KPATCH CVE-2022-0492] cgroup-v1: kpatch fixes for CVE-2022-0492 Kernels: 4.18.0-348.el8 4.18.0-348.2.1.el8_5 4.18.0-348.7.1.el8_5 4.18.0-348.12.2.el8_5 Changes since last build: arches: x86_64 ppc64le cgroup-v1.o: changed function: cgroup1_parse_param cgroup-v1.o: changed function: cgroup_release_agent_write --------------------------- Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/26 Approved-by: Yannick Cote (@ycote1) Kernels: 4.18.0-348.el8 4.18.0-348.2.1.el8_5 4.18.0-348.7.1.el8_5 4.18.0-348.12.2.el8_5 Modifications: none commit 07650ec60ef7ae3d33cde8faed38770c838ff4b1 Author: Waiman Long Date: Tue Feb 8 19:21:47 2022 -0500 cgroup-v1: Require capabilities to set release_agent Bugzilla: https://bugzilla.redhat.com/2052166 CVE: CVE-2022-0492 Y-Commit: 55f79b1a4b02276a6edda7cb7ef5ec0c585141a1 O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2052167 O-CVE: CVE-2022-0492 commit 24f6008564183aa120d07c03d9289519c2fe02af Author: Eric W. Biederman Date: Thu, 20 Jan 2022 11:04:01 -0600 cgroup-v1: Require capabilities to set release_agent The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable Tested-by: Tabitha Sable Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" Signed-off-by: Tejun Heo Signed-off-by: Waiman Long Signed-off-by: Bruno Meneguele Signed-off-by: Joe Lawrence --- kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 852f1349f9d9..fdf337ccda6b 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -544,6 +544,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns != &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp = cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -951,6 +959,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) /* Specifying two release agents is forbidden */ if (ctx->release_agent) return invalfc(fc, "release_agent respecified"); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) + return invalfc(fc, "Setting release_agent not allowed"); ctx->release_agent = param->string; param->string = NULL; break; -- 2.34.1