Re: [oss-security] CVE Request: Linux: IB/security: Restrict use of the write() interface'

Christoph Hellwig
2016-05-08T08:00:52Z

On Sat, May 07, 2016 at 08:19:46PM +0200, Yann Droneaud wrote:
> I thought access_ok() done as part of copy_to_user() would protect from
> such unwelcomed behavior. But it's not if the kernel invoke write()
> handler outside of a user process.

It does. Core dumps are an obious example, although I fail to see
how an unprivilegued user could set the core dump pattern to involve
an IB uverbs device. The other hint in the patch is that it checks
for the credentials, which suggests suid/sgid binaries are part of
the issue.

But the combination of the write abuse and allowing users to use the
device nodes is bound to be lethal sooner or later, so I'm not surprised
about issues popping up.