Bug 866842 (CVE-2014-0102) - VUL-1: CVE-2014-0102: kernel: keyrings: search_nested_keyrings can crash the system
Summary: VUL-1: CVE-2014-0102: kernel: keyrings: search_nested_keyrings can crash the ...
Status: RESOLVED FIXED
Alias: CVE-2014-0102
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Joey Lee
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/96772/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-05 06:13 UTC by Marcus Meissner
Modified: 2014-09-01 13:55 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2014-03-05 06:13:11 UTC
via oss-sec

The problem is that search_nested_keyrings() sees two keyrings that have
matching type and description, so keyring_compare_object() returns true.
s_n_k() then passes the key to the iterator function -
keyring_detect_cycle_iterator() - which *should* check to see whether
this is
the keyring of interest, not just one with the same name and, leads to
BUG_ON.

An unprivileged local user could use this flaw to crash the system. 

Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b2a4df200d570b2c33a57e1ebfa5896e4bc81b69

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1072419
https://lkml.org/lkml/2014/2/27/507

Upstream patch:
http://www.kernelhub.org/?msg=425013&p=2


References:
http://comments.gmane.org/gmane.comp.security.oss.general/12279
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Comment 1 Marcus Meissner 2014-03-05 06:15:01 UTC
given that it was introduced september 2013 it probably only affects 13.1/Factory/SLE12
Comment 2 Marcus Meissner 2014-03-05 06:15:20 UTC
CVE-2014-0102
Comment 3 Swamp Workflow Management 2014-03-05 23:00:18 UTC
bugbot adjusting priority
Comment 7 Joey Lee 2014-03-28 04:01:53 UTC
David's patch merged to v3.14-rc6 kernel on upstream:

commit 979e0d74651ba5aa533277f2a6423d0f982fb6f6
Author: David Howells <dhowells@redhat.com>
Date:   Sun Mar 9 08:21:58 2014 +0000

    KEYS: Make the keyring cycle detector ignore other keyrings of the same nam


I will backport it to openSUSE 13.1 and SLE-12.
Comment 8 Joey Lee 2014-03-28 04:58:21 UTC
Patch pushed to SLE-12 kernel branch:

commit 2eea5801d812dac65e60070975c6ac64d88b7216
Author: Lee, Chun-Yi <jlee@suse.com>
Date:   Fri Mar 28 12:57:15 2014 +0800

    KEYS: Make the keyring cycle detector ignore other keyrings
    of the same name (bnc#866842, CVE-2014-0102).
Comment 9 Joey Lee 2014-03-28 05:34:42 UTC
Did not see keyring_detect_cycle_iterator() function in openSUSE 13.1 kernel. I think don't need apply backported patch.
Comment 10 Marcus Meissner 2014-09-01 13:55:32 UTC
thanks, so it seems fixed!