rpms/kernel/F-12 xfs-prevent-swapext-from-operating-on-write-only-files.patch, NONE, 1.1 kernel.spec, 1.2115, 1.2116
Chuck Ebbert
cebbert at fedoraproject.org
Tue Jul 27 19:56:01 UTC 2010
Author: cebbert
Update of /cvs/pkgs/rpms/kernel/F-12
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv28987
Modified Files:
kernel.spec
Added Files:
xfs-prevent-swapext-from-operating-on-write-only-files.patch
Log Message:
xfs-prevent-swapext-from-operating-on-write-only-files.patch:
CVE-2010-2266
xfs-prevent-swapext-from-operating-on-write-only-files.patch:
xfs_dfrag.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- NEW FILE xfs-prevent-swapext-from-operating-on-write-only-files.patch ---
From: Dan Rosenberg <dan.j.rosenberg at gmail.com>
Date: Thu, 24 Jun 2010 02:07:47 +0000 (+1000)
Subject: xfs: prevent swapext from operating on write-only files
X-Git-Tag: v2.6.35-rc4~4^2~4
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1817176a86352f65210139d4c794ad2d19fc6b63
xfs: prevent swapext from operating on write-only files
[ cve-2010-2266 ]
[ cebbert at redhat.com : backport to 2.6.32 ]
This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it. It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg at gmail.com>
Reviewed-by: Christoph Hellwig <hch at lst.de>
---
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 5bba29a..7f159d2 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -69,7 +69,9 @@ xfs_swapext(
goto out;
}
- if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+ if (!(file->f_mode & FMODE_WRITE) ||
+ !(file->f_mode & FMODE_READ) ||
+ (file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_file;
}
@@ -81,6 +83,7 @@ xfs_swapext(
}
if (!(target_file->f_mode & FMODE_WRITE) ||
+ !(target_file->f_mode & FMODE_READ) ||
(target_file->f_flags & O_APPEND)) {
error = XFS_ERROR(EBADF);
goto out_put_target_file;
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-12/kernel.spec,v
retrieving revision 1.2115
retrieving revision 1.2116
diff -u -p -r1.2115 -r1.2116
--- kernel.spec 27 Jul 2010 19:13:49 -0000 1.2115
+++ kernel.spec 27 Jul 2010 19:55:59 -0000 1.2116
@@ -852,6 +852,7 @@ Patch14050: crypto-add-async-hash-testin
Patch14100: cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
Patch14110: ext4-make-sure-the-move_ext-ioctl-can-t-overwrite-append-only-files.patch
+Patch14115: xfs-prevent-swapext-from-operating-on-write-only-files.patch
Patch14120: usb-obey-the-sysfs-power-wakeup-setting.patch
@@ -1574,6 +1575,8 @@ ApplyPatch crypto-add-async-hash-testing
ApplyPatch cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
# CVE-2010-2066
ApplyPatch ext4-make-sure-the-move_ext-ioctl-can-t-overwrite-append-only-files.patch
+# CVE-2010-2266
+ApplyPatch xfs-prevent-swapext-from-operating-on-write-only-files.patch
# fix broken USB device wakeups (#617559)
ApplyPatch usb-obey-the-sysfs-power-wakeup-setting.patch
@@ -2230,6 +2233,10 @@ fi
%kernel_variant_files -k vmlinux %{with_kdump} kdump
%changelog
+* Tue Jul 27 2010 Chuck Ebbert <cebbert at redhat.com> 2.6.32.16-154
+- xfs-prevent-swapext-from-operating-on-write-only-files.patch:
+ CVE-2010-2266
+
* Tue Jul 27 2010 Jarod Wilson <jarod at redhat.com> 2.6.32.16-153
- kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch:
Fix crash in guest Python programs (#610911)
More information about the scm-commits
mailing list