diff mbox series

[2/2] AppArmor: Fix lsm_get_self_attr()

Message ID 20240223190546.3329966-2-mic@digikod.net (mailing list archive)
State Accepted
Delegated to: Paul Moore
Headers show
Series [1/2] SELinux: Fix lsm_get_self_attr() | expand

Commit Message

Mickaël Salaün Feb. 23, 2024, 7:05 p.m. UTC
aa_getprocattr() may not initialize the value's pointer in some case.
As for proc_pid_attr_read(), initialize this pointer to NULL in
apparmor_getselfattr() to avoid an UAF in the kfree() call.

Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: stable@vger.kernel.org
Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
Signed-off-by: Mickaël Salaün <mic@digikod.net>
---
 security/apparmor/lsm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Paul Moore Feb. 23, 2024, 9:07 p.m. UTC | #1
On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
>
> aa_getprocattr() may not initialize the value's pointer in some case.
> As for proc_pid_attr_read(), initialize this pointer to NULL in
> apparmor_getselfattr() to avoid an UAF in the kfree() call.
>
> Cc: Casey Schaufler <casey@schaufler-ca.com>
> Cc: John Johansen <john.johansen@canonical.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: stable@vger.kernel.org
> Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> ---
>  security/apparmor/lsm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

If you like John, I can send this up to Linus with the related SELinux
fix, I would just need an ACK from you.

> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index 98e1150bee9d..9a3dcaafb5b1 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -784,7 +784,7 @@ static int apparmor_getselfattr(unsigned int attr, struct lsm_ctx __user *lx,
>         int error = -ENOENT;
>         struct aa_task_ctx *ctx = task_ctx(current);
>         struct aa_label *label = NULL;
> -       char *value;
> +       char *value = NULL;
>
>         switch (attr) {
>         case LSM_ATTR_CURRENT:
> --
> 2.43.0
Paul Moore Feb. 26, 2024, 7:59 p.m. UTC | #2
On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> >
> > aa_getprocattr() may not initialize the value's pointer in some case.
> > As for proc_pid_attr_read(), initialize this pointer to NULL in
> > apparmor_getselfattr() to avoid an UAF in the kfree() call.
> >
> > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > Cc: John Johansen <john.johansen@canonical.com>
> > Cc: Paul Moore <paul@paul-moore.com>
> > Cc: stable@vger.kernel.org
> > Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > ---
> >  security/apparmor/lsm.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> If you like John, I can send this up to Linus with the related SELinux
> fix, I would just need an ACK from you.

Reviewed-by: Paul Moore <paul@paul-moore.com>

This patch looks good to me, and while we've still got at least two
(maybe three?) more weeks before v6.8 is tagged, I think it would be
good to get this up to Linus ASAP.  I'll hold off for another day, but
if we don't see any comment from John I'll go ahead and merge this and
send it up to Linus with the SELinux fix; I'm sure John wouldn't be
happy if v6.8 went out the door without this fix.

> > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> > index 98e1150bee9d..9a3dcaafb5b1 100644
> > --- a/security/apparmor/lsm.c
> > +++ b/security/apparmor/lsm.c
> > @@ -784,7 +784,7 @@ static int apparmor_getselfattr(unsigned int attr, struct lsm_ctx __user *lx,
> >         int error = -ENOENT;
> >         struct aa_task_ctx *ctx = task_ctx(current);
> >         struct aa_label *label = NULL;
> > -       char *value;
> > +       char *value = NULL;
> >
> >         switch (attr) {
> >         case LSM_ATTR_CURRENT:
> > --
> > 2.43.0
Paul Moore Feb. 27, 2024, 4:01 p.m. UTC | #3
On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
> On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> > >
> > > aa_getprocattr() may not initialize the value's pointer in some case.
> > > As for proc_pid_attr_read(), initialize this pointer to NULL in
> > > apparmor_getselfattr() to avoid an UAF in the kfree() call.
> > >
> > > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > > Cc: John Johansen <john.johansen@canonical.com>
> > > Cc: Paul Moore <paul@paul-moore.com>
> > > Cc: stable@vger.kernel.org
> > > Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> > > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > > ---
> > >  security/apparmor/lsm.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > If you like John, I can send this up to Linus with the related SELinux
> > fix, I would just need an ACK from you.
>
> Reviewed-by: Paul Moore <paul@paul-moore.com>
>
> This patch looks good to me, and while we've still got at least two
> (maybe three?) more weeks before v6.8 is tagged, I think it would be
> good to get this up to Linus ASAP.  I'll hold off for another day, but
> if we don't see any comment from John I'll go ahead and merge this and
> send it up to Linus with the SELinux fix; I'm sure John wouldn't be
> happy if v6.8 went out the door without this fix.

I just merged this into lsm/stable-6.8 and once the automated
build/test has done it's thing and come back clean I'll send this,
along with the associated SELinux fix, up to Linus.  Thanks all.

John, if this commit is problematic please let me know and I'll send a
fix or a revert.
Paul Moore Feb. 27, 2024, 10:09 p.m. UTC | #4
On Tue, Feb 27, 2024 at 11:01 AM Paul Moore <paul@paul-moore.com> wrote:
> On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> > > >
> > > > aa_getprocattr() may not initialize the value's pointer in some case.
> > > > As for proc_pid_attr_read(), initialize this pointer to NULL in
> > > > apparmor_getselfattr() to avoid an UAF in the kfree() call.
> > > >
> > > > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > > > Cc: John Johansen <john.johansen@canonical.com>
> > > > Cc: Paul Moore <paul@paul-moore.com>
> > > > Cc: stable@vger.kernel.org
> > > > Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> > > > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > > > ---
> > > >  security/apparmor/lsm.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > If you like John, I can send this up to Linus with the related SELinux
> > > fix, I would just need an ACK from you.
> >
> > Reviewed-by: Paul Moore <paul@paul-moore.com>
> >
> > This patch looks good to me, and while we've still got at least two
> > (maybe three?) more weeks before v6.8 is tagged, I think it would be
> > good to get this up to Linus ASAP.  I'll hold off for another day, but
> > if we don't see any comment from John I'll go ahead and merge this and
> > send it up to Linus with the SELinux fix; I'm sure John wouldn't be
> > happy if v6.8 went out the door without this fix.
>
> I just merged this into lsm/stable-6.8 and once the automated
> build/test has done it's thing and come back clean I'll send this,
> along with the associated SELinux fix, up to Linus.  Thanks all.

In off-list discussions with Mickaël today it was noted that this
patch also needs a fixup to the commit description so I've replaced it
with the following:

  "In apparmor_getselfattr() when an invalid AppArmor
   attribute is requested, or a value hasn't been explicitly
   set for the requested attribute, the label passed to
   aa_put_label() is not properly initialized which can cause
   problems when the pointer value is non-NULL and AppArmor
   attempts to drop a reference on the bogus label object."

I've updated the commit in lsm/stable-6.8 and I'll be sending it to
Linus shortly.

> John, if this commit is problematic please let me know and I'll send a
> fix or a revert.
Paul Moore Feb. 27, 2024, 10:13 p.m. UTC | #5
On Tue, Feb 27, 2024 at 5:09 PM Paul Moore <paul@paul-moore.com> wrote:
> On Tue, Feb 27, 2024 at 11:01 AM Paul Moore <paul@paul-moore.com> wrote:
> > On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> > > > >
> > > > > aa_getprocattr() may not initialize the value's pointer in some case.
> > > > > As for proc_pid_attr_read(), initialize this pointer to NULL in
> > > > > apparmor_getselfattr() to avoid an UAF in the kfree() call.
> > > > >
> > > > > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > > > > Cc: John Johansen <john.johansen@canonical.com>
> > > > > Cc: Paul Moore <paul@paul-moore.com>
> > > > > Cc: stable@vger.kernel.org
> > > > > Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> > > > > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > > > > ---
> > > > >  security/apparmor/lsm.c | 2 +-
> > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > If you like John, I can send this up to Linus with the related SELinux
> > > > fix, I would just need an ACK from you.
> > >
> > > Reviewed-by: Paul Moore <paul@paul-moore.com>
> > >
> > > This patch looks good to me, and while we've still got at least two
> > > (maybe three?) more weeks before v6.8 is tagged, I think it would be
> > > good to get this up to Linus ASAP.  I'll hold off for another day, but
> > > if we don't see any comment from John I'll go ahead and merge this and
> > > send it up to Linus with the SELinux fix; I'm sure John wouldn't be
> > > happy if v6.8 went out the door without this fix.
> >
> > I just merged this into lsm/stable-6.8 and once the automated
> > build/test has done it's thing and come back clean I'll send this,
> > along with the associated SELinux fix, up to Linus.  Thanks all.
>
> In off-list discussions with Mickaël today it was noted that this
> patch also needs a fixup to the commit description so I've replaced it
> with the following:
>
>   "In apparmor_getselfattr() when an invalid AppArmor
>    attribute is requested, or a value hasn't been explicitly
>    set for the requested attribute, the label passed to
>    aa_put_label() is not properly initialized which can cause
>    problems when the pointer value is non-NULL and AppArmor
>    attempts to drop a reference on the bogus label object."
>
> I've updated the commit in lsm/stable-6.8 and I'll be sending it to
> Linus shortly.
>
> > John, if this commit is problematic please let me know and I'll send a
> > fix or a revert.

I also just realized that both this patch and the SELinux have the
stable kernel marking which shouldn't be necessary as the LSM syscalls
are only present in the v6.8-rcX kernels.  I'm going to drop the
stable tagging, but leave the 'Fixes:' tag of course.
Mickaël Salaün Feb. 28, 2024, 12:53 p.m. UTC | #6
On Tue, Feb 27, 2024 at 05:13:58PM -0500, Paul Moore wrote:
> On Tue, Feb 27, 2024 at 5:09 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Tue, Feb 27, 2024 at 11:01 AM Paul Moore <paul@paul-moore.com> wrote:
> > > On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > > On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> > > > > >
> > > > > > aa_getprocattr() may not initialize the value's pointer in some case.
> > > > > > As for proc_pid_attr_read(), initialize this pointer to NULL in
> > > > > > apparmor_getselfattr() to avoid an UAF in the kfree() call.
> > > > > >
> > > > > > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > > > > > Cc: John Johansen <john.johansen@canonical.com>
> > > > > > Cc: Paul Moore <paul@paul-moore.com>
> > > > > > Cc: stable@vger.kernel.org
> > > > > > Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> > > > > > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > > > > > ---
> > > > > >  security/apparmor/lsm.c | 2 +-
> > > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > >
> > > > > If you like John, I can send this up to Linus with the related SELinux
> > > > > fix, I would just need an ACK from you.
> > > >
> > > > Reviewed-by: Paul Moore <paul@paul-moore.com>
> > > >
> > > > This patch looks good to me, and while we've still got at least two
> > > > (maybe three?) more weeks before v6.8 is tagged, I think it would be
> > > > good to get this up to Linus ASAP.  I'll hold off for another day, but
> > > > if we don't see any comment from John I'll go ahead and merge this and
> > > > send it up to Linus with the SELinux fix; I'm sure John wouldn't be
> > > > happy if v6.8 went out the door without this fix.
> > >
> > > I just merged this into lsm/stable-6.8 and once the automated
> > > build/test has done it's thing and come back clean I'll send this,
> > > along with the associated SELinux fix, up to Linus.  Thanks all.
> >
> > In off-list discussions with Mickaël today it was noted that this
> > patch also needs a fixup to the commit description so I've replaced it
> > with the following:
> >
> >   "In apparmor_getselfattr() when an invalid AppArmor
> >    attribute is requested, or a value hasn't been explicitly
> >    set for the requested attribute, the label passed to
> >    aa_put_label() is not properly initialized which can cause
> >    problems when the pointer value is non-NULL and AppArmor
> >    attempts to drop a reference on the bogus label object."
> >
> > I've updated the commit in lsm/stable-6.8 and I'll be sending it to
> > Linus shortly.
> >
> > > John, if this commit is problematic please let me know and I'll send a
> > > fix or a revert.
> 
> I also just realized that both this patch and the SELinux have the
> stable kernel marking which shouldn't be necessary as the LSM syscalls
> are only present in the v6.8-rcX kernels.  I'm going to drop the
> stable tagging, but leave the 'Fixes:' tag of course.

Looks good, thanks!

> 
> -- 
> paul-moore.com
>
John Johansen May 10, 2024, 4:10 p.m. UTC | #7
On 2/27/24 08:01, Paul Moore wrote:
> On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
>> On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
>>> On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
>>>>
>>>> aa_getprocattr() may not initialize the value's pointer in some case.
>>>> As for proc_pid_attr_read(), initialize this pointer to NULL in
>>>> apparmor_getselfattr() to avoid an UAF in the kfree() call.
>>>>
>>>> Cc: Casey Schaufler <casey@schaufler-ca.com>
>>>> Cc: John Johansen <john.johansen@canonical.com>
>>>> Cc: Paul Moore <paul@paul-moore.com>
>>>> Cc: stable@vger.kernel.org
>>>> Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
>>>> Signed-off-by: Mickaël Salaün <mic@digikod.net>
>>>> ---
>>>>   security/apparmor/lsm.c | 2 +-
>>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> If you like John, I can send this up to Linus with the related SELinux
>>> fix, I would just need an ACK from you.
>>
>> Reviewed-by: Paul Moore <paul@paul-moore.com>
>>
>> This patch looks good to me, and while we've still got at least two
>> (maybe three?) more weeks before v6.8 is tagged, I think it would be
>> good to get this up to Linus ASAP.  I'll hold off for another day, but
>> if we don't see any comment from John I'll go ahead and merge this and
>> send it up to Linus with the SELinux fix; I'm sure John wouldn't be
>> happy if v6.8 went out the door without this fix.
> 
> I just merged this into lsm/stable-6.8 and once the automated
> build/test has done it's thing and come back clean I'll send this,
> along with the associated SELinux fix, up to Linus.  Thanks all.
> 
> John, if this commit is problematic please let me know and I'll send a
> fix or a revert.
> 

sorry, I am still trying to dig out of my backlog. This is good, you can
certainly have my ACK, I know its already in tree so no point in adding
it there but wanted to just make sure its on list
Paul Moore May 13, 2024, 2:57 p.m. UTC | #8
On Fri, May 10, 2024 at 12:10 PM John Johansen
<john.johansen@canonical.com> wrote:
> On 2/27/24 08:01, Paul Moore wrote:
> > On Mon, Feb 26, 2024 at 2:59 PM Paul Moore <paul@paul-moore.com> wrote:
> >> On Fri, Feb 23, 2024 at 4:07 PM Paul Moore <paul@paul-moore.com> wrote:
> >>> On Fri, Feb 23, 2024 at 2:06 PM Mickaël Salaün <mic@digikod.net> wrote:
> >>>>
> >>>> aa_getprocattr() may not initialize the value's pointer in some case.
> >>>> As for proc_pid_attr_read(), initialize this pointer to NULL in
> >>>> apparmor_getselfattr() to avoid an UAF in the kfree() call.
> >>>>
> >>>> Cc: Casey Schaufler <casey@schaufler-ca.com>
> >>>> Cc: John Johansen <john.johansen@canonical.com>
> >>>> Cc: Paul Moore <paul@paul-moore.com>
> >>>> Cc: stable@vger.kernel.org
> >>>> Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> >>>> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> >>>> ---
> >>>>   security/apparmor/lsm.c | 2 +-
> >>>>   1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> If you like John, I can send this up to Linus with the related SELinux
> >>> fix, I would just need an ACK from you.
> >>
> >> Reviewed-by: Paul Moore <paul@paul-moore.com>
> >>
> >> This patch looks good to me, and while we've still got at least two
> >> (maybe three?) more weeks before v6.8 is tagged, I think it would be
> >> good to get this up to Linus ASAP.  I'll hold off for another day, but
> >> if we don't see any comment from John I'll go ahead and merge this and
> >> send it up to Linus with the SELinux fix; I'm sure John wouldn't be
> >> happy if v6.8 went out the door without this fix.
> >
> > I just merged this into lsm/stable-6.8 and once the automated
> > build/test has done it's thing and come back clean I'll send this,
> > along with the associated SELinux fix, up to Linus.  Thanks all.
> >
> > John, if this commit is problematic please let me know and I'll send a
> > fix or a revert.
>
> sorry, I am still trying to dig out of my backlog. This is good, you can
> certainly have my ACK, I know its already in tree so no point in adding
> it there but wanted to just make sure its on list

No worries, reviews are still appreciated; just because a patch has
made its way up to Linus is no guarantee there isn't something wrong
with it ;)
diff mbox series

Patch

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 98e1150bee9d..9a3dcaafb5b1 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -784,7 +784,7 @@  static int apparmor_getselfattr(unsigned int attr, struct lsm_ctx __user *lx,
 	int error = -ENOENT;
 	struct aa_task_ctx *ctx = task_ctx(current);
 	struct aa_label *label = NULL;
-	char *value;
+	char *value = NULL;
 
 	switch (attr) {
 	case LSM_ATTR_CURRENT: