rpms/kernel/F-12 xfs-prevent-swapext-from-operating-on-write-only-files.patch, NONE, 1.1 kernel.spec, 1.2115, 1.2116

Chuck Ebbert cebbert at fedoraproject.org
Tue Jul 27 19:56:01 UTC 2010


Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-12
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv28987

Modified Files:
	kernel.spec 
Added Files:
	xfs-prevent-swapext-from-operating-on-write-only-files.patch 
Log Message:
xfs-prevent-swapext-from-operating-on-write-only-files.patch:
  CVE-2010-2266

xfs-prevent-swapext-from-operating-on-write-only-files.patch:
 xfs_dfrag.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- NEW FILE xfs-prevent-swapext-from-operating-on-write-only-files.patch ---
From: Dan Rosenberg <dan.j.rosenberg at gmail.com>
Date: Thu, 24 Jun 2010 02:07:47 +0000 (+1000)
Subject: xfs: prevent swapext from operating on write-only files
X-Git-Tag: v2.6.35-rc4~4^2~4
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1817176a86352f65210139d4c794ad2d19fc6b63

xfs: prevent swapext from operating on write-only files
[ cve-2010-2266 ]
[ cebbert at redhat.com : backport to 2.6.32 ]

This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it.  It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg at gmail.com>
Reviewed-by: Christoph Hellwig <hch at lst.de>
---

diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 5bba29a..7f159d2 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -69,7 +69,9 @@ xfs_swapext(
 		goto out;
 	}
 
-	if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+	if (!(file->f_mode & FMODE_WRITE) ||
+	    !(file->f_mode & FMODE_READ) ||
+	    (file->f_flags & O_APPEND)) {
 		error = XFS_ERROR(EBADF);
 		goto out_put_file;
 	}
@@ -81,6 +83,7 @@ xfs_swapext(
 	}
 
 	if (!(target_file->f_mode & FMODE_WRITE) ||
+	    !(target_file->f_mode & FMODE_READ) ||
 	    (target_file->f_flags & O_APPEND)) {
 		error = XFS_ERROR(EBADF);
 		goto out_put_target_file;


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-12/kernel.spec,v
retrieving revision 1.2115
retrieving revision 1.2116
diff -u -p -r1.2115 -r1.2116
--- kernel.spec	27 Jul 2010 19:13:49 -0000	1.2115
+++ kernel.spec	27 Jul 2010 19:55:59 -0000	1.2116
@@ -852,6 +852,7 @@ Patch14050: crypto-add-async-hash-testin
 
 Patch14100: cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
 Patch14110: ext4-make-sure-the-move_ext-ioctl-can-t-overwrite-append-only-files.patch
+Patch14115: xfs-prevent-swapext-from-operating-on-write-only-files.patch
 
 Patch14120: usb-obey-the-sysfs-power-wakeup-setting.patch
 
@@ -1574,6 +1575,8 @@ ApplyPatch crypto-add-async-hash-testing
 ApplyPatch cifs-fix-malicious-redirect-problem-in-the-dns-lookup-code.patch
 # CVE-2010-2066
 ApplyPatch ext4-make-sure-the-move_ext-ioctl-can-t-overwrite-append-only-files.patch
+# CVE-2010-2266
+ApplyPatch xfs-prevent-swapext-from-operating-on-write-only-files.patch
 
 # fix broken USB device wakeups (#617559)
 ApplyPatch usb-obey-the-sysfs-power-wakeup-setting.patch
@@ -2230,6 +2233,10 @@ fi
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Tue Jul 27 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.32.16-154
+- xfs-prevent-swapext-from-operating-on-write-only-files.patch:
+  CVE-2010-2266
+
 * Tue Jul 27 2010 Jarod Wilson <jarod at redhat.com> 2.6.32.16-153
 - kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch:
   Fix crash in guest Python programs (#610911)



More information about the scm-commits mailing list