CVE-2012-2745: Buffer Overflow
keyctlsessiontoparent(task) sets ->replacementsessionkeyring, it should be processed and cleared by keyreplacesessionkeyring().
However, this task can fork before it notices TIFNOTIFYRESUME and the new child gets the bogus ->replacementsessionkeyring copied by duptaskstruct(). This is obviously wrong and, if nothing else, this leads to putcred(alreadyfreedcred).
This causes the following panic on ppc64: Kernel panic - not syncing: CRED: putcredrcu() sees c0000001f41a4480 with usage -1
Call Trace: [c0000001fff53bc0] [c000000000012f04] .showstack+0x74/0x1c0 (unreliable) [c0000001fff53c70] [c0000000005c2d18] .panic+0xb8/0x1ec [c0000001fff53d00] [c0000000000c7858] .putcredrcu+0x118/0x120 [c0000001fff53d80] [c000000000117708] .rcuprocesscallbacks+0x158/0x3f0 [c0000001fff53e30] [c0000000001179d4] .rcuprocesscallbacks+0x34/0x70 [c0000001fff53eb0] [c00000000009cb18] .dosoftirq+0x118/0x290 [c0000001fff53f90] [c000000000031e28] .calldosoftirq+0x14/0x24 [c0000001fcf7b990] [c00000000000e700] .dosoftirq+0xf0/0x110 [c0000001fcf7ba30] [c00000000009c834] .irqexit+0xb4/0xc0 [c0000001fcf7bab0] [c00000000002e3b8] .timerinterrupt+0x108/0x160 [c0000001fcf7bb40] [c000000000003718] decrementercommon+0x118/0x180 --- Exception: 901 at .rawlocalirqrestore+0x54/0x60 LR = .cpuidle+0x14c/0x1d0
Because powerpc does not, currently, call keyreplacesessionkeyring() from the TIFNOTIFYRESUME handler. i386, x8664, s390 and ia64 all do call the keyrings code and so the attack window is much smaller - though still present.
An unprivileged local user could use this flaw to crash the system.
Introduced by: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee18d64c
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=79549c6dfda0603dba9a70a53467ce62d9335c33
Other sources
The copycreds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2745?
CVE-2012-2745 is considered to have a medium severity level potentially allowing for local privilege escalation.
How do I fix CVE-2012-2745?
To mitigate CVE-2012-2745, update to a patched version of the Linux kernel, specifically 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions are affected by CVE-2012-2745?
CVE-2012-2745 affects multiple versions of the Linux kernel up to and including 3.3.1.
What type of vulnerability is CVE-2012-2745?
CVE-2012-2745 is a local privilege escalation vulnerability due to improper handling of session keyrings during task forking.
Is CVE-2012-2745 exploitable remotely?
CVE-2012-2745 is not remotely exploitable; it requires local access to the vulnerable system.