In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smack: fix incorrect task context in smack_msg_queue_msgrcv<\/p>\n
The smack_msg_queue_msgrcv() function incorrectly checks
\nthe permissions of the ‘current’ task instead of the
\n‘target’ task.<\/p>\n
In the msgsnd() syscall path, if a receiver is already waiting,
\nthe pipelined_send() optimization is used to push the message
\ndirectly to the receiver task:<\/p>\n
ipc\/msg.c`pipelined_send():
\n ` smp_store_release(&msr->r_msg, msg)<\/p>\n
In this case, the ‘sender’ (current) task performs the check
\non behalf of the ‘receiver’ task (msr->r_tsk, passed as the
\n‘target’ parameter):<\/p>\n
ipc\/msg.c`pipelined_send():
\n ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,)<\/p>\n
However, smack_msg_queue_msgrcv() ignores the ‘target’ and
\nchecks ‘current’:<\/p>\n
smack_msg_queue_msgrcv(\u2026)
\n ` smk_curacc_msq(isp, MAY_READWRITE); \/\/ current task<\/p>\n
‘current’ MAY satisfy smack_msg_queue_msgrcv r\/w requirement,
\nbut ‘target’ (the receiver task) might NOT;
\nas a result, an unauthorized receiver gets the message,
\nviolating MAC policy.<\/p>\n
Test:
\n1) create a sysv message queue with label \u201cfoo\u201d
\n2) echo “bar foo r” >\/smack\/load2
\n3) msgrcv(,,,0,MSG_NOERROR) in “bar”-labeled task.
\n The task is waiting for the messages …
\n4) msgsnd() from a “foo”-labeled task:
\n“bar”-labeled task gets the message.<\/p>\n
This patch fixes the issue by checking permission on the
\n‘target’ task instead of ‘current’.<\/p>\n
(2008-02-04, Casey Schaufler)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smack: fix incorrect task context in smack_msg_queue_msgrcv<\/p>\n
The smack_msg_queue_msgrcv() function incorrectly checks
\nthe permissio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26048","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26048","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26048"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26048"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26048"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}