From b65b67b51768d6a2ecc6cdadb1551be4f5558726 Mon Sep 17 00:00:00 2001 From: Miroslav Franc Date: Mar 10 2023 16:52:24 +0000 Subject: tap: tap_open(): correctly initialize socket uid (CVE-2023-1076 bsc#1208599). --- diff --git a/patches.suse/tap-tap_open-correctly-initialize-socket-uid.patch b/patches.suse/tap-tap_open-correctly-initialize-socket-uid.patch new file mode 100644 index 0000000..51470f8 --- /dev/null +++ b/patches.suse/tap-tap_open-correctly-initialize-socket-uid.patch @@ -0,0 +1,43 @@ +From: Pietro Borrello +Date: Sat, 4 Feb 2023 17:39:22 +0000 +Subject: tap: tap_open(): correctly initialize socket uid +Git-commit: 66b2c338adce580dfce2199591e65e2bab889cff +Patch-mainline: v6.3-rc1 +References: CVE-2023-1076 bsc#1208599 + +sock_init_data() assumes that the `struct socket` passed in input is +contained in a `struct socket_alloc` allocated with sock_alloc(). +However, tap_open() passes a `struct socket` embedded in a `struct +tap_queue` allocated with sk_alloc(). +This causes a type confusion when issuing a container_of() with +SOCK_INODE() in sock_init_data() which results in assigning a wrong +sk_uid to the `struct sock` in input. +On default configuration, the type confused field overlaps with +padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu +*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, +i.e., the root one. +Fix the assignment by using sock_init_data_uid(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Acked-by: Miroslav Franc +--- + drivers/net/tap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index a2be1994b389..8941aa199ea3 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -533,7 +533,7 @@ static int tap_open(struct inode *inode, struct file *file) + q->sock.state = SS_CONNECTED; + q->sock.file = file; + q->sock.ops = &tap_socket_ops; +- sock_init_data(&q->sock, &q->sk); ++ sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); + q->sk.sk_write_space = tap_sock_write_space; + q->sk.sk_destruct = tap_sock_destruct; + q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; + diff --git a/series.conf b/series.conf index 6994812..a2fa010 100644 --- a/series.conf +++ b/series.conf @@ -23068,6 +23068,7 @@ patches.suse/net-mpls-fix-stale-pointer-if-allocation-fails-durin.patch patches.suse/net-add-sock_init_data_uid.patch patches.suse/tun-tun_chr_open-correctly-initialize-socket-uid.patch + patches.suse/tap-tap_open-correctly-initialize-socket-uid.patch patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch # netdev/net