Bug 1580979 (CVE-2017-18270)

Summary:	CVE-2017-18270 kernel: improper keyrings creation
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, airlied, allarkin, aquini, bhu, blc, bskeggs, dbaker, dhoward, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, john.j5live, jokerman, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, skozina, slawomir, steved, sthangav, trankin, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.13.5	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel in the way a local user could create keyrings for other users via keyctl commands. This may allow an attacker to set unwanted defaults, a denial of service, or possibly leak keyring information between users.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:26:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1582352, 1582353
Bug Blocks:	1580980, 1775606

Description Laura Pardo 2018-05-21 21:48:31 UTC

A flaw was found in the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands. This may allow to set unwanted defaults or cause a denial of service.


References:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5

Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=237bbd29f7a049d310d907f4b2716a7feef9abf3 	
https://github.com/torvalds/linux/commit/237bbd29f7a049d310d907f4b2716a7feef9abf3

Comment 5 Petr Matousek 2020-08-12 12:06:01 UTC

*** Bug 1856774 has been marked as a duplicate of this bug. ***

Comment 6 Petr Matousek 2020-08-12 12:12:20 UTC

Acknowledgments:

Name: Eric Biggers (Google)

Comment 7 Petr Matousek 2020-08-12 12:12:26 UTC

Statement:

The impact is Moderate, because the impact is only for userspace programs if using keyctl incorrectly. For root-level processes (usually during boot) keyctl being used securely without possibility of leaking keys between users.

Comment 8 Petr Matousek 2020-08-12 12:12:31 UTC

External References:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=237bbd29f7a049d310d907f4b2716a7feef9abf3
http://kernsec.org/pipermail/linux-security-module-archive/2017-September/003318.html