Commit c3a9d654 authored Apr 10, 2006 by David Howells Committed by Linus Torvalds Apr 10, 2006

[Security] Keys: Fix oops when adding key to non-keyring



This fixes the problem of an oops occuring when a user attempts to add a
key to a non-keyring key [CVE-2006-1522].

The problem is that __keyring_search_one() doesn't check that the
keyring it's been given is actually a keyring.

I've fixed this problem by:

 (1) declaring that caller of __keyring_search_one() must guarantee that
     the keyring is a keyring; and

 (2) making key_create_or_update() check that the keyring is a keyring,
     and return -ENOTDIR if it isn't.

This can be tested by:

	keyctl add user b b `keyctl add user a a @s`

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 460fbf82

security/keys/key.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,

		key_check(keyring);

		key_ref = ERR_PTR(-ENOTDIR);
		if (keyring->type != &key_type_keyring)
		goto error_2;

		down_write(&keyring->sem);

		/* if we're going to allocate a new key, we're going to have

security/keys/keyring.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
		/*
		* search the given keyring only (no recursion)
		* - keyring must be locked by caller
		* - caller must guarantee that the keyring is a keyring
		*/
		key_ref_t __keyring_search_one(key_ref_t keyring_ref,
		const struct key_type *ktype,

Admin message