Bug 1185469 (CVE-2013-7421)

Mathias Krause reports:

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API
that allows any local user to load any installed kernel module on systems
where CONFIG_CRYPTO_USER_API=y by abusing the request_module() call.

In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the request_module() kernel call.


The intention was to allow applications to leverage in-kernel cryptographic functionality and load the requested module on demand.

The kernel accomplished loading algorithms by searching for the matching
kernel module name provided when a user attempts to use a socket via the
AF_ALG socket type.  Initially there were no checks involved in validating
the name of the module, users could provide string and the kernel would
attempt to load a module by that name in the default search path for the
specific version of the kernel.

The proposed fix for CVE-2013-7421 solved the issue for the simple use case, however there was an additional attack vector which by changing the string formatting any module can still be loaded.

External reference:
https://lkml.org/lkml/2013/3/4/70
https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu
http://seclists.org/oss-sec/2015/q1/229


Fixed with these 3 commits:
https://git.kernel.org/linus/5d26a105b5a7
https://git.kernel.org/linus/4943ba16bbc2
https://git.kernel.org/linus/3e14dcf7cb80

I have only done light testing and they seem to solve it for me.