From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D85BC43461 for ; Fri, 30 Apr 2021 11:40:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE1DB61077 for ; Fri, 30 Apr 2021 11:40:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231696AbhD3Lk5 (ORCPT ); Fri, 30 Apr 2021 07:40:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:59918 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229875AbhD3Lkz (ORCPT ); Fri, 30 Apr 2021 07:40:55 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 42967613E7; Fri, 30 Apr 2021 11:40:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1619782807; bh=OjYzE8T7BuqxJ1VhQlAFv+4eubSMW/QGjcutTf6y2+I=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=V/ToOwGejOhOwWuf9hwzPC0G7hrYeEhLuLxfWAgEx3gMHULOEBQaiikDtkd4k6t7/ fQn+u69UszqWaRtIWG8s/Ax7q9vkkl4Z/OcNt8o9z6wAgY1FcP8b3bxwwWZOTgsYQX +b4y7b4wRrbQvr4eoONRzKRm1VTgwP2aYvFTOkPQ= Date: Fri, 30 Apr 2021 13:40:05 +0200 From: Greg KH To: Kasper Zwijsen Cc: "tglx@linutronix.de" , "linux-kernel@vger.kernel.org" , "security@kernel.org" , stable@vger.kernel.org Subject: Re: Semantic Bug: Privilege Bypass in timerfd for 4.4.y Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Apr 30, 2021 at 10:57:59AM +0000, Kasper Zwijsen wrote: > Dear Thomas Gleixner, > > > I believe I have found a semantic security bug in the form of a missing capability check in the timerfd_create and timerfd_settime system calls for the 4.4.y LTS kernel. > > In this commit: https://github.com/torvalds/linux/commit/2895a5e5b3ae78d9923a91fce405d4a2f32c4309, > capability checks for CAP_WAKE_ALARM were added for creating and setting a CLOCK_BOOTTIME_ALARM and CLOCK_REALTIME_ALARM. > This security patch was applied to all but one LTS kernel, namely 4.4.y. That is because it showed up in the 4.8 release, there was nothing to "apply" to any newer kernels :) > It is therefore still possible for a user process without any privileges to create and set such a timer, resulting in the process being able to wake up the system. > > The man pages state that creating or setting such a timer requires privileges. Similarly, the timer_create system call does check the correct permissions. > I therefore believe this is unintended and a semantic bug. > I have tested the original patch and found that it can simply be applied to the latest 4.4.y kernel (4.4.268 as of right now) without any issues. > The patch: https://lore.kernel.org/patchwork/patch/686888/ I've now queued this up for the next 4.4.y release. In the future, you should just email the stable@vger.kernel.org address any git commit ids that you feel need to be backported. thanks! greg k-h