Mathias Krause reports: Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API that allows any local user to load any installed kernel module on systems where CONFIG_CRYPTO_USER_API=y by abusing the request_module() call. In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the request_module() kernel call. The intention was to allow applications to leverage in-kernel cryptographic functionality and load the requested module on demand. The kernel accomplished loading algorithms by searching for the matching kernel module name provided when a user attempts to use a socket via the AF_ALG socket type. Initially there were no checks involved in validating the name of the module, users could provide string and the kernel would attempt to load a module by that name in the default search path for the specific version of the kernel. The proposed fix for CVE-2013-7421 solved the issue for the simple use case, however there was an additional attack vector which by changing the string formatting any module can still be loaded. External reference: https://lkml.org/lkml/2013/3/4/70 https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu http://seclists.org/oss-sec/2015/q1/229 Fixed with these 3 commits: https://git.kernel.org/linus/5d26a105b5a7 https://git.kernel.org/linus/4943ba16bbc2 https://git.kernel.org/linus/3e14dcf7cb80 I have only done light testing and they seem to solve it for me.
Edited comment #0 to include additional information.
Statement: This issue did not affect the versions of the kernel as shipped with Red Hat Enterprise Linux 4, 5, and 6. This issue affects the versions of the Linux as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1190934]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2411 https://rhn.redhat.com/errata/RHSA-2015-2411.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html