Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78541c1d authored by Andrew Lutomirski's avatar Andrew Lutomirski Committed by David S. Miller
Browse files

net: Fix ns_capable check in sock_diag_put_filterinfo 



The caller needs capabilities on the namespace being queried, not on
their own namespace.  This is a security bug, although it likely has
only a minor impact.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b0bda385

include/linux/sock_diag.h

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie); 
void sock_diag_save_cookie(void *sk, __u32 *cookie);



int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);

int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,

int sock_diag_put_filterinfo(struct sock *sk,

			     struct sk_buff *skb, int attrtype);



#endif

net/core/sock_diag.c

+2 −2
Original line number Diff line number Diff line
@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) 
}

EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);



int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,

int sock_diag_put_filterinfo(struct sock *sk,

			     struct sk_buff *skb, int attrtype)

{

	struct sock_fprog_kern *fprog;
@@ -58,7 +58,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, 
	unsigned int flen;

	int err = 0;



	if (!ns_capable(user_ns, CAP_NET_ADMIN)) {

	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {

		nla_reserve(skb, attrtype, 0);

		return 0;

	}

net/packet/diag.c

+1 −1
Original line number Diff line number Diff line
@@ -172,7 +172,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, 
		goto out_nlmsg_trim;



	if ((req->pdiag_show & PACKET_SHOW_FILTER) &&

	    sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER))

	    sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER))

		goto out_nlmsg_trim;



	return nlmsg_end(skb, nlh);