• Kees Cook's avatar
    futex: Do not leak robust list to unprivileged process · bdbb776f
    Kees Cook authored
    It was possible to extract the robust list head address from a setuid
    process if it had used set_robust_list(), allowing an ASLR info leak. This
    changes the permission checks to be the same as those used for similar
    info that comes out of /proc.
    
    Running a setuid program that uses robust futexes would have had:
      cred->euid != pcred->euid
      cred->euid == pcred->uid
    so the old permissions check would allow it. I'm not aware of any setuid
    programs that use robust futexes, so this is just a preventative measure.
    
    (This patch is based on changes from grsecurity.)
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Darren Hart <dvhart@linux.intel.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Jiri Kosina <jkosina@suse.cz>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    Cc: David Howells <dhowells@redhat.com>
    Cc: Serge E. Hallyn <serge.hallyn@canonical.com>
    Cc: kernel-hardening@lists.openwall.com
    Cc: spender@grsecurity.net
    Link: http://lkml.kernel.org/r/20120319231253.GA20893@www.outflux.netSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    bdbb776f
futex.c 70.8 KB