Skip to contentSkip to conversation

AppArmor: fix oops in apparmor_setprocattr

PATCH In review Kees Cook 3 participants 4 messages May 31, 2011 – Jun 1, 2011

Subsystems (2)
Security (LSM) Apparmor security module
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 AppArmor: fix oops in apparmor_setprocattr

When invalid parameters are passed to apparmor_setprocattr a NULL deref oops occurs when it tries to record an audit message. This is because it is passing NULL for the profile parameter for aa_audit. But aa_audit now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to setprocattr.

Signed-off-by Kees Cook <[email protected]>
Signed-off-by John Johansen <[email protected]>
---
 security/apparmor/lsm.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
security/apparmor/lsm.c +2 -1
index ae3a698..ec1bcec 100644
@@ -593,7 +593,8 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
 			sa.aad.op = OP_SETPROCATTR;
 			sa.aad.info = name;
 			sa.aad.error = -EINVAL;
-			return aa_audit(AUDIT_APPARMOR_DENIED, NULL, GFP_KERNEL,
+			return aa_audit(AUDIT_APPARMOR_DENIED,
+					__aa_current_profile(), GFP_KERNEL,
 					&sa, NULL);
 		}
 	} else if (strcmp(name, "exec") == 0) {
Signature · 6 lines
1.7.4.1


-- 
Kees Cook
Ubuntu Security Team
maintainer
#1 lore raw
Quoted 7 lines · Kees Cook

When invalid parameters are passed to apparmor_setprocattr a NULL deref oops occurs when it tries to record an audit message. This is because it is passing NULL for the profile parameter for aa_audit. But aa_audit now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to setprocattr.

Is this trigger able by unprivileged users?

Quoted 1 line

From which upstream commit is this an issue?

- James

Signature · 2 lines
James Morris
<[email protected]>
#2 lore raw
Quoted 1 line · James Morris

Is this trigger able by unprivileged users?

Anybody who can call .setprocattr LSM hook can trigger this bug, but for most configurations BUG_ON() will prevent NULL pointer dereference.

179 int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
180 struct common_audit_data *sa,
181 void (*cb) (struct audit_buffer *, void *))
182 {
183 BUG_ON(!profile);

Quoted 1 line

From which upstream commit is this an issue?

Since 2.6.36.

author
#3 lore raw
In reply to James Morris

Hi James,

Quoted 10 lines · James Morris
Quoted 7 lines · Kees Cook

When invalid parameters are passed to apparmor_setprocattr a NULL deref oops occurs when it tries to record an audit message. This is because it is passing NULL for the profile parameter for aa_audit. But aa_audit now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to setprocattr.

Is this trigger able by unprivileged users?

Yes, but the Oops kills the process doing the write as it triggers the BUG_ON, not the process being written to.

Quoted 1 line
Quoted 1 line

From which upstream commit is this an issue?

b5e95b48685e3481139a5634d14d630d12c7d5ce

-Kees

Signature · 2 lines
Kees Cook
Ubuntu Security Team