Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/net
History
Eric W. Biederman 1141a45580 net: Use netlink_ns_capable to verify the permisions of netlink messages 
[ Upstream commit 90f62cf30a78721641e08737bda787552428061e ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2014-06-26 15:12:37 -04:00
..
9p 9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers 2014-03-06 21:30:03 -08:00
802 net/802/mrp: fix lockdep splat 2013-05-14 13:02:30 -07:00
8021q vlan: Fix lockdep warning when vlan dev handle notification 2014-05-30 21:52:15 -07:00
appletalk net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
atm net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
ax25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
batman-adv batman-adv: set up network coding packet handlers during module init 2013-11-20 12:27:47 -08:00
bluetooth Bluetooth: Fix redundant encryption request for reauthentication 2014-06-07 13:25:33 -07:00
bridge bridge: Handle IFLA_ADDRESS correctly when creating bridge device 2014-05-30 21:52:16 -07:00
caif net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
can net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
ceph libceph: fix corruption when using page_count 0 page in rbd 2014-06-07 13:25:40 -07:00
core net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dcb net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dccp net:dccp: do not report ICMP redirects to user space 2013-10-13 16:08:30 -07:00
decnet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dns_resolver
…
dsa
…
ethernet
…
ieee802154 6lowpan: fix lockdep splats 2014-03-06 21:30:02 -08:00
ipv4 netfilter: ipv4: defrag: set local_df flag on defragmented skb 2014-06-16 13:42:53 -07:00
ipv6 netfilter: Fix potential use after free in ip6_route_me_harder() 2014-06-11 12:03:27 -07:00
ipx net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
irda net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
iucv net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
key net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
l2tp l2tp: take PMTU from tunnel UDP socket 2014-05-30 21:52:14 -07:00
lapb
…
llc net: llc: fix use after free in llc_ui_recvmsg 2014-01-15 15:28:50 -08:00
mac80211 mac80211: fix on-channel remain-on-channel 2014-06-07 13:25:31 -07:00
mac802154 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-30 03:55:20 -04:00
netfilter net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
netlabel netlabel: improve domain mapping validation 2013-05-19 14:49:55 -07:00
netlink net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
netrom net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
nfc net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
openvswitch openvswitch: Remove unneeded ovs_netdev_get_ifindex() 2013-04-30 00:19:11 -04:00
packet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
phonet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
rds rds: prevent dereference of a NULL device in rds_iw_laddr_check 2014-04-14 06:42:18 -07:00
rfkill
…
rose net: rose: restore old recvmsg behavior 2014-01-15 15:28:49 -08:00
rxrpc net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
sched net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
sctp sctp: reset flowi4_oif parameter on route lookup 2014-05-30 21:52:16 -07:00
sunrpc nfsd: check passed socket's net matches NFSd superblock's one 2014-05-06 07:55:29 -07:00
tipc net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
unix net: unix: non blocking recvmsg() should not return -EINTR 2014-04-14 06:42:15 -07:00
vmw_vsock net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
wimax
…
wireless radiotap: fix bitmap-end-finding buffer overrun 2014-01-09 12:24:23 -08:00
x25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
xfrm net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile
…
compat.c x86, x32: Correct invalid use of user timespec in the kernel 2014-02-06 11:08:12 -08:00
nonet.c
…
socket.c net: socket: error on a negative msg_namelen 2014-04-14 06:42:16 -07:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-13 16:08:34 -07:00