CVE-2009-4131: High severity linux kernel vulnerability

Description of problem: From 910123ba363623f15ffb5d05dd87bdf06d08c609 Mon Sep 17 00:00:00 2001 From: Akira Fujita <a-fujita.nec.com> Date: Sun, 6 Dec 2009 23:38:31 -0500 Subject: [PATCH] ext4: Fix insufficient checks in EXT4IOCMOVEEXT

This patch fixes three problems in the handling of the EXT4IOCMOVEEXT ioctl:

1. In current EXT4IOCMOVEEXT, there are read access mode checks for original and donor files, but they allow the illegal write access to donor file, since donor file is overwritten by original file data. To fix this problem, change access mode checks of original (r->r/w) and donor (r->w) files.

2. Disallow the use of donor files that have a setuid or setgid bits.

3. Call mntwantwrite() and mntdropwrite() before and after ext4moveextents() calling to get write access to a mount.

Signed-off-by: Akira Fujita <a-fujita.nec.com> Signed-off-by: "Theodore Ts'o" <tytso> --- fs/ext4/ioctl.c | 30 ++++++++++++++++++------------ fs/ext4/moveextent.c | 7 +++++++ 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 31e5ee0..b63d193 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -221,32 +221,38 @@ setversionout: struct file donorfilp; int err; + if (!(filp->fmode & FMODEREAD) || + !(filp->fmode & FMODEWRITE)) + return -EBADF; + if (copyfromuser(&me, (struct moveextent user )arg, sizeof(me))) return -EFAULT; + me.movedlen = 0; donorfilp = fget(me.donorfd); if (!donorfilp) return -EBADF; - if (!capable(CAPDACOVERRIDE)) { - if ((current->realcred->fsuid != inode->iuid) || - !(inode->imode & SIRUSR) || - !(donorfilp->fdentry->dinode->imode & - SIRUSR)) { - fput(donorfilp); - return -EACCES; - } + if (!(donorfilp->fmode & FMODEWRITE)) { + err = -EBADF; + goto mextout; } - me.movedlen = 0; + err = mntwantwrite(filp->fpath.mnt); + if (err) + goto mextout; + err = ext4moveextents(filp, donorfilp, me.origstart, me.donorstart, me.len, &me.movedlen); - fput(donorfilp); + mntdropwrite(filp->fpath.mnt); + if (me.movedlen > 0) + fileremovesuid(donorfilp); if (copytouser((struct moveextent )arg, &me, sizeof(me))) - return -EFAULT; - + err = -EFAULT; +mextout: + fput(donorfilp); return err; } diff --git a/fs/ext4/moveextent.c b/fs/ext4/moveextent.c index cad1e2e..82c415b 100644 --- a/fs/ext4/moveextent.c +++ b/fs/ext4/moveextent.c @@ -957,6 +957,13 @@ mextcheckarguments(struct inode originode, return -EINVAL; } + if (donorinode->imode & (SISUID|SISGID)) { + ext4debug("ext4 move extent: suid or sgid is set" + " to donor file [ino:orig %lu, donor %lu]\n", + originode->iino, donorinode->iino); + return -EINVAL; + } + / Ext4 move extent does not support swapfile / if (ISSWAPFILE(originode) || ISSWAPFILE(donorinode)) { ext4debug("ext4 move extent: The argument files should " -- 1.6.5.216.g5288a.dirty