Kees Cook c0d30628ff exec/ptrace: fix get_dumpable() incorrect tests ... commit d049f74f2d upstream. The get_dumpable() return value is not boolean. Most users of the function actually want to be testing for non-SUID_DUMP_USER(1) rather than SUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a protected state. Almost all places did this correctly, excepting the two places fixed in this patch. Wrong logic: if (dumpable == SUID_DUMP_DISABLE) { /* be protective */ } or if (dumpable == 0) { /* be protective */ } or if (!dumpable) { /* be protective */ } Correct logic: if (dumpable != SUID_DUMP_USER) { /* be protective */ } or if (dumpable != 1) { /* be protective */ } Without this patch, if the system had set the sysctl fs/suid_dumpable=2, a user was able to ptrace attach to processes that had dropped privileges to that user. (This may have been partially mitigated if Yama was enabled.) The macros have been moved into the file that declares get/set_dumpable(), which means things like the ia64 code can see them too. CVE-2013-2929 Reported-by: Vasily Kulikov <segoon@openwall.com> Signed-off-by: Kees Cook <keescook@chromium.org> Cc: "Luck, Tony" <tony.luck@intel.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-11-29 10:50:34 -08:00
..
acpi
asm-generic	mm: allow arch code to control the user page table ceiling	2013-05-07 19:51:55 -07:00
crypto
drm	drm/radeon: add new richland pci ids	2013-05-11 13:48:14 -07:00
keys
linux	exec/ptrace: fix get_dumpable() incorrect tests	2013-11-29 10:50:34 -08:00
math-emu
media	media: v4l2: added missing mutex.h include to v4l2-ctrls.h	2013-09-26 17:15:49 -07:00
misc
mtd
net	net: fix cipso packet validation when !NETLABEL	2013-11-04 04:23:41 -08:00
pcmcia
rdma
rxrpc
scsi
sound	ALSA: Add a reference counter to card instance	2012-11-17 13:16:13 -08:00
target	target: Add link_magic for fabric allow_link destination target_items	2013-01-21 11:45:24 -08:00
trace	xen/mmu: Use Xen specific TLB flush instead of the generic one.	2012-11-17 13:15:54 -08:00
video	atmel_lcdfb: fix 16-bpp modes on older SOCs	2013-03-20 13:05:00 -07:00
xen	xen/blkback: correctly respond to unknown, non-native requests	2013-04-05 10:04:18 -07:00
Kbuild