Bug 1528335 (CVE-2017-17807)

Summary:	CVE-2017-17807 kernel: Missing permissions check for request_key() destination allows local attackers to add keys to keyring without Write permission
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agordeev, airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, skozina, slawomir, steved, vdronov, williams, wmealing, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 14.4.6	Doc Type:	If docs needed, set a value
Doc Text:	The KEYS subsystem in the Linux kernel omitted an access-control check when writing a key to the current task's default keyring, allowing a local user to bypass security checks to the keyring. This compromises the validity of the keyring for those who rely on it.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-31 22:31:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1528337, 1528346, 1543261, 1543262, 1543263, 1543264, 1543265
Bug Blocks:	1528348

Description Adam Mariš 2017-12-21 15:10:40 UTC

The KEYS subsystem in the Linux kernel omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.

Upstream patch:

https://github.com/torvalds/linux/commit/4dca6ea1d9432052afb06baf2e3ae78188a4410b

Comment 1 Adam Mariš 2017-12-21 15:13:15 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1528337]

Comment 3 Justin M. Forbes 2018-01-29 17:57:03 UTC

This was fixed for Fedora with the 4.14.6 stable updates.

Comment 10 Vladis Dronov 2018-02-22 13:47:50 UTC

Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Comment 11 errata-xmlrpc 2020-03-31 19:11:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1016 https://access.redhat.com/errata/RHSA-2020:1016

Comment 12 errata-xmlrpc 2020-03-31 19:20:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1070 https://access.redhat.com/errata/RHSA-2020:1070

Comment 13 Product Security DevOps Team 2020-03-31 22:31:56 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-17807