kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/xfrm
History
Eric W. Biederman be0ef855ba net: Use netlink_ns_capable to verify the permisions of netlink messages 
[ Upstream commit 90f62cf30a ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2014-06-26 15:15:38 -04:00
..
Kconfig net/xfrm: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:03 -08:00
Makefile xfrm: make xfrm_algo.c a module 2012-05-15 13:13:34 -04:00
xfrm_algo.c net: move pskb_put() to core code 2013-11-07 19:28:58 -05:00
xfrm_hash.c net: allow GFP_HIGHMEM in __vmalloc() 2010-11-21 10:04:04 -08:00
xfrm_hash.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
xfrm_input.c xfrm: checkpatch errors with foo * bar 2014-01-02 07:48:49 +01:00
xfrm_ipcomp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
xfrm_output.c xfrm: choose protocol family by skb protocol 2013-08-19 09:39:04 +02:00
xfrm_policy.c xfrm: Fix unlink race when policies are deleted. 2014-02-26 09:52:02 +01:00
xfrm_proc.c xfrm: checkpatch errors with space 2014-01-02 07:48:48 +01:00
xfrm_replay.c xfrm: Fix aevent generation for each received packet 2013-09-25 07:32:48 +02:00
xfrm_state.c xfrm: Clone states properly on migration 2014-02-20 14:30:10 +01:00
xfrm_sysctl.c net: Don't export sysctls to unprivileged users 2012-11-18 20:30:55 -05:00
xfrm_user.c net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:15:38 -04:00