[kernel/f15/master] CVE-2011-1182: kernel signal spoofing issue

[Chuck Ebbert]

commit 06ad6a4c25545784308248db8cabb417adf160ed
Author: Chuck Ebbert <cebbert at redhat.com>
Date:   Fri Mar 25 10:15:57 2011 -0400

    CVE-2011-1182: kernel signal spoofing issue

 kernel.spec                                        |   11 +++-
 ...igqueueinfo-from-spoofing-the-signal-code.patch |   64 ++++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index 405c30c..1a35832 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -51,7 +51,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be prepended with "0.", so
 # for example a 3 here will become 0.3
 #
-%global baserelease 6
+%global baserelease 7
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -738,6 +738,9 @@ Patch12421: fs-call-security_d_instantiate-in-d_obtain_alias.patch
 # Fix possible memory corruption on Dell HW
 Patch12430: dcdbas-force-smi-to-happen-when-expected.patch
 
+# CVE-2011-1182
+Patch12431: prevent-rt_sigqueueinfo-and-rt_tgsigqueueinfo-from-spoofing-the-signal-code.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1372,6 +1375,9 @@ ApplyPatch fs-call-security_d_instantiate-in-d_obtain_alias.patch
 # Fix possible memory corruption on Dell HW
 ApplyPatch dcdbas-force-smi-to-happen-when-expected.patch
 
+# CVE-2011-1182
+ApplyPatch prevent-rt_sigqueueinfo-and-rt_tgsigqueueinfo-from-spoofing-the-signal-code.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1980,6 +1986,9 @@ fi
 # and build.
 
 %changelog
+* Fri Mar 25 2011 Chuck Ebbert <cebbert at redhat.com>
+- CVE-2011-1182: kernel signal spoofing issue
+
 * Wed Mar 23 2011 Chuck Ebbert <cebbert at redhat.com> 2.6.38.1-6
 - Linux 2.6.38.1
 - Drop linux-2.6-ehci-check-port-status.patch, merged in .38.1
diff --git a/prevent-rt_sigqueueinfo-and-rt_tgsigqueueinfo-from-spoofing-the-signal-code.patch b/prevent-rt_sigqueueinfo-and-rt_tgsigqueueinfo-from-spoofing-the-signal-code.patch
new file mode 100644
index 0000000..747a0e3
--- /dev/null
+++ b/prevent-rt_sigqueueinfo-and-rt_tgsigqueueinfo-from-spoofing-the-signal-code.patch
@@ -0,0 +1,64 @@
+From: Julien Tinnes <jln at google.com>
+Date: Fri, 18 Mar 2011 22:05:21 +0000 (-0700)
+Subject: Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=da48524eb20662618854bb3df2db01fc65f3070c
+
+Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code
+
+Userland should be able to trust the pid and uid of the sender of a
+signal if the si_code is SI_TKILL.
+
+Unfortunately, the kernel has historically allowed sigqueueinfo() to
+send any si_code at all (as long as it was negative - to distinguish it
+from kernel-generated signals like SIGILL etc), so it could spoof a
+SI_TKILL with incorrect siginfo values.
+
+Happily, it looks like glibc has always set si_code to the appropriate
+SI_QUEUE, so there are probably no actual user code that ever uses
+anything but the appropriate SI_QUEUE flag.
+
+So just tighten the check for si_code (we used to allow any negative
+value), and add a (one-time) warning in case there are binaries out
+there that might depend on using other si_code values.
+
+Signed-off-by: Julien Tinnes <jln at google.com>
+Acked-by: Oleg Nesterov <oleg at redhat.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 4e3cff1..3175186 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2421,9 +2421,13 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
+ 		return -EFAULT;
+ 
+ 	/* Not even root can pretend to send signals from the kernel.
+-	   Nor can they impersonate a kill(), which adds source info.  */
+-	if (info.si_code >= 0)
++	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
++	 */
++	if (info.si_code != SI_QUEUE) {
++		/* We used to allow any < 0 si_code */
++		WARN_ON_ONCE(info.si_code < 0);
+ 		return -EPERM;
++	}
+ 	info.si_signo = sig;
+ 
+ 	/* POSIX.1b doesn't mention process groups.  */
+@@ -2437,9 +2441,13 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
+ 		return -EINVAL;
+ 
+ 	/* Not even root can pretend to send signals from the kernel.
+-	   Nor can they impersonate a kill(), which adds source info.  */
+-	if (info->si_code >= 0)
++	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
++	 */
++	if (info->si_code != SI_QUEUE) {
++		/* We used to allow any < 0 si_code */
++		WARN_ON_ONCE(info->si_code < 0);
+ 		return -EPERM;
++	}
+ 	info->si_signo = sig;
+ 
+ 	return do_send_specific(tgid, pid, sig, info);