Bug 100506 (CVE-2005-2098)

We received the following report via vendor-sec.
This issue is not public yet, please keep any information about it inside SUSE.

Date: Wed, 3 Aug 2005 14:01:31 +0100 (BST)
From: Mark J Cox <mjc@redhat.com>
To: vendor-sec@lst.de
Subject: [vendor-sec] [Security] CAN-2005-2098 Error during attempt to join key management
 session can leave semaphore pinned (fwd)

---------- Forwarded message ----------
Date: Wed, 03 Aug 2005 13:19:03 +0100
From: David Howells <dhowells@redhat.com>
To: security@kernel.org
Subject: [Security] CAN-2005-2098 Error during attempt to join key management
    session can leave semaphore pinned


The attached patch prevents an error during the key session joining operation
from hanging future joins in the D state [CAN-2005-2098].

The problem is that the error handling path for the 
KEYCTL_JOIN_SESSION_KEYRING
operation has one error path that doesn't release the session management
semaphore. Further attempts to get the semaphore will then sleep for ever in
the D state.

This can happen in four situations, all involving an attempt to allocate a 
new
session keyring:

 (1) ENOMEM.

 (2) The users key quota being reached.

 (3) A keyring name that is an empty string.

 (4) A keyring name that is too long.

Any user may attempt this operation, and so any user can cause the problem to
occur.

Signed-Off-By: David Howells <dhowells@redhat.com>
---
warthog>diffstat -p1 /tmp/linux-2.6.13-key-session-error.patch
 security/keys/process_keys.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.9/security/keys/process_keys.c.orig	2005-08-02 
21:37:05.000000000 +0100
+++ linux-2.6.9/security/keys/process_keys.c	2005-08-02 
21:37:07.000000000 +0100
@@ -678,7 +678,7 @@ long join_session_keyring(const char *na
 		keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);
 		if (IS_ERR(keyring)) {
 			ret = PTR_ERR(keyring);
-			goto error;
+			goto error2;
 		}
 	}
 	else if (IS_ERR(keyring)) {

_______________________________________________
Security mailing list
Security@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/security
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec