|
 |
915baa |
From 49fc47e81624d594ff10837b9cd34f14c9e26046 Mon Sep 17 00:00:00 2001
|
|
|
915baa |
From: Ryan Sullivan <rysulliv@redhat.com>
|
|
|
915baa |
Date: Wed, 15 Mar 2023 09:20:36 -0400
|
|
|
915baa |
Subject: [KPATCH CVE-2023-0386] kpatch fixes for CVE-2023-0386
|
|
|
915baa |
|
|
|
915baa |
Kernels:
|
|
|
915baa |
4.18.0-425.3.1.el8
|
|
|
915baa |
4.18.0-425.10.1.el8_7
|
|
|
915baa |
4.18.0-425.13.1.el8_7
|
|
|
915baa |
|
|
|
915baa |
|
|
|
915baa |
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/92
|
|
|
915baa |
Approved-by: Joe Lawrence (@joe.lawrence)
|
|
|
915baa |
Approved-by: Yannick Cote (@ycote1)
|
|
|
915baa |
Changes since last build:
|
|
|
915baa |
[x86_64]:
|
|
|
915baa |
copy_up.o: changed function: ovl_copy_up_one
|
|
|
915baa |
copy_up.o: new function: ovl_do_copy_up
|
|
|
915baa |
|
|
|
915baa |
[ppc64le]:
|
|
|
915baa |
copy_up.o: changed function: ovl_copy_up_one
|
|
|
915baa |
|
|
|
915baa |
---------------------------
|
|
|
915baa |
|
|
|
915baa |
Modifications: none
|
|
|
915baa |
|
|
|
915baa |
commit a9ae1a96322125120bbb5177b1c76586f886a8db
|
|
|
915baa |
Author: Miklos Szeredi <mszeredi@redhat.com>
|
|
|
915baa |
Date: Tue Jan 24 16:41:18 2023 +0100
|
|
|
915baa |
|
|
|
915baa |
ovl: fail on invalid uid/gid mapping at copy up
|
|
|
915baa |
|
|
|
915baa |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165341
|
|
|
915baa |
CVE: CVE-2023-0386
|
|
|
915baa |
|
|
|
915baa |
If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then
|
|
|
915baa |
copy-up should fail, just like it would fail if the mounter task was doing
|
|
|
915baa |
the copy using "cp -a".
|
|
|
915baa |
|
|
|
915baa |
There's a corner case where the "cp -a" would succeed but copy up fail: if
|
|
|
915baa |
there's a mapping of the invalid uid/gid (65534 by default) in the user
|
|
|
915baa |
namespace. This is because stat(2) will return this value if the mapping
|
|
|
915baa |
doesn't exist in the current user_ns and "cp -a" will in turn be able to
|
|
|
915baa |
create a file with this uid/gid.
|
|
|
915baa |
|
|
|
915baa |
This behavior would be inconsistent with POSIX ACL's, which return -1 for
|
|
|
915baa |
invalid uid/gid which result in a failed copy.
|
|
|
915baa |
|
|
|
915baa |
For consistency and simplicity fail the copy of the st_uid/st_gid are
|
|
|
915baa |
invalid.
|
|
|
915baa |
|
|
|
915baa |
Fixes: 459c7c565ac3 ("ovl: unprivieged mounts")
|
|
|
915baa |
Cc: <stable@vger.kernel.org> # v5.11
|
|
|
915baa |
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
|
915baa |
Reviewed-by: Christian Brauner <brauner@kernel.org>
|
|
|
915baa |
Reviewed-by: Seth Forshee <sforshee@kernel.org>
|
|
|
915baa |
(cherry picked from commit 4f11ada10d0ad3fd53e2bd67806351de63a4f9c3)
|
|
|
915baa |
|
|
|
915baa |
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
|
915baa |
|
|
|
915baa |
Signed-off-by: Ryan Sullivan <rysulliv@redhat.com>
|
|
|
915baa |
---
|
|
|
915baa |
fs/overlayfs/copy_up.c | 4 ++++
|
|
|
915baa |
1 file changed, 4 insertions(+)
|
|
|
915baa |
|
|
|
915baa |
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
|
|
|
915baa |
index edd818b77aac..7c51ca835fc7 100644
|
|
|
915baa |
--- a/fs/overlayfs/copy_up.c
|
|
|
915baa |
+++ b/fs/overlayfs/copy_up.c
|
|
|
915baa |
@@ -889,6 +889,10 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
|
|
|
915baa |
if (err)
|
|
|
915baa |
return err;
|
|
|
915baa |
|
|
|
915baa |
+ if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) ||
|
|
|
915baa |
+ !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
|
|
|
915baa |
+ return -EOVERFLOW;
|
|
|
915baa |
+
|
|
|
915baa |
ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
|
|
|
915baa |
|
|
|
915baa |
if (parent) {
|
|
|
915baa |
--
|
|
|
915baa |
2.39.2
|
|
|
915baa |
|
|
|
915baa |
|