Commit 666c135b authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tun-tap-uid' 



Laszlo Ersek says:

====================
tun/tap: set sk_uid from current_fsuid()

The original patches fixing CVE-2023-1076 are incorrect in my opinion.
This small series fixes them up; see the individual commit messages for
explanation.

I have a very elaborate test procedure demonstrating the problem for
both tun and tap; it involves libvirt, qemu, and "crash". I can share
that procedure if necessary, but it's indeed quite long (I wrote it
originally for our QE team).

The patches in this series are supposed to "re-fix" CVE-2023-1076; given
that said CVE is classified as Low Impact (CVSSv3=5.5), I'm posting this
publicly, and not suggesting any embargo. Red Hat Product Security may
assign a new CVE number later.

I've tested the patches on top of v6.5-rc4, with "crash" built at commit
c74f375e0ef7.

Cc: Eric Dumazet <edumazet@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pietro Borrello <borrello@diag.uniroma1.it>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 31d49ba0 5c9241f3

drivers/net/tap.c

+1 −1
Original line number Diff line number Diff line
@@ -534,7 +534,7 @@ static int tap_open(struct inode *inode, struct file *file) 
	q->sock.state = SS_CONNECTED;

	q->sock.file = file;

	q->sock.ops = &tap_socket_ops;

	sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);

	sock_init_data_uid(&q->sock, &q->sk, current_fsuid());

	q->sk.sk_write_space = tap_sock_write_space;

	q->sk.sk_destruct = tap_sock_destruct;

	q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;

drivers/net/tun.c

+1 −1
Original line number Diff line number Diff line
@@ -3469,7 +3469,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) 
	tfile->socket.file = file;

	tfile->socket.ops = &tun_socket_ops;



	sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);

	sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid());



	tfile->sk.sk_write_space = tun_sock_write_space;

	tfile->sk.sk_sndbuf = INT_MAX;