From patchwork Tue Apr 24 22:03:21 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [CVE-2012-2123] lucid/natty fcaps: clear the same personality flags as suid when fcaps are used Date: Tue, 24 Apr 2012 12:03:21 -0000 From: Steve Conklin X-Patchwork-Id: 154766 Message-Id: <4F972329.60400@canonical.com> To: kernel-team@lists.ubuntu.com This is a clean application of an upstream patch. The same fix has already come from upstream stable for Oneiric and Precise. -Steve >From c825bb675aea46fe858b58d1d31dccc6bb7c03c1 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Tue, 17 Apr 2012 16:26:54 -0400 Subject: [PATCH] fcaps: clear the same personality flags as suid when fcaps are used CVE-2012-2123 BugLink: http://bugs.launchpad.net/bugs/987571 If a process increases permissions using fcaps all of the dangerous personality flags which are cleared for suid apps should also be cleared. Thus programs given priviledge with fcaps will continue to have address space randomization enabled even if the parent tried to disable it to make it easier to attack. Signed-off-by: Eric Paris Reviewed-by: Serge Hallyn Signed-off-by: James Morris (cherry picked from commit d52fc5dde1) Signed-off-by: Steve Conklin --- security/commoncap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/commoncap.c b/security/commoncap.c index 50be79b..5d5f64b 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -512,6 +512,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) } skip: + /* if we have fs caps, clear dangerous personality flags */ + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) + bprm->per_clear |= PER_CLEAR_ON_SETID; + + /* Don't let someone trace a set[ug]id/setpcap binary with the revised * credentials unless they have the appropriate permit */