Ruihan Li
48cdcb40d5
bluetooth: Perform careful capability checks in hci_sock_ioctl() ...
commit 25c150ac103a4ebeed0319994c742a90634ddf18 upstream.
Previously, capability was checked using capable(), which verified that the
caller of the ioctl system call had the required capability. In addition,
the result of the check would be stored in the HCI_SOCK_TRUSTED flag,
making it persistent for the socket.
However, malicious programs can abuse this approach by deliberately sharing
an HCI socket with a privileged task. The HCI socket will be marked as
trusted when the privileged task occasionally makes an ioctl call.
This problem can be solved by using sk_capable() to check capability, which
ensures that not only the current task but also the socket opener has the
specified capability, thus reducing the risk of privilege escalation
through the previously identified vulnerability.
Cc: stable@vger.kernel.org
Fixes: f81f5b2db8
2023-05-17 11:35:31 +02:00
9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
2023-04-20 12:07:36 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-04-20 12:07:32 +02:00
bluetooth: Perform careful capability checks in hci_sock_ioctl()
2023-05-17 11:35:31 +02:00
bpf: Move skb->len == 0 checks into __bpf_redirect
2023-01-18 11:41:04 +01:00
netfilter: br_netfilter: fix recent physdev match breakage
2023-04-26 11:24:01 +02:00
net: caif: Fix use-after-free in cfusbl_device_notify()
2023-03-17 08:32:51 +01:00
can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
2023-04-20 12:07:34 +02:00
net: don't let netpoll invoke NAPI if in xmit context
2023-04-20 12:07:33 +02:00
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
2023-04-26 11:24:05 +02:00
net: dsa: ksz: Check return value
2022-12-14 11:30:45 +01:00
hsr: Avoid double remove of a node.
2023-01-18 11:41:09 +01:00
net: ieee802154: fix error return code in dgram_bind()
2022-11-03 23:56:54 +09:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
2023-04-26 11:24:05 +02:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-04-20 12:07:32 +02:00
kcm: close race conditions on sk_receive_queue
2022-11-25 17:42:21 +01:00
af_key: Fix send_acquire race with pfkey_register
2022-12-08 11:22:57 +01:00
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
2023-04-26 11:24:05 +02:00
wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
2023-04-20 12:07:33 +02:00
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
2022-12-14 11:30:45 +01:00
net: mpls: fix stale pointer if allocation fails during device rename
2023-02-22 12:50:41 +01:00
netfilter: nft_redir: correct value of inet type .maxattrs
2023-03-22 13:28:04 +01:00
netlink: annotate data races around sk_state
2023-02-06 07:52:45 +01:00
netrom: Fix use-after-free caused by accept on already connected socket
2023-02-22 12:50:24 +01:00
nfc: change order inside nfc_se_io error path
2023-03-17 08:32:48 +01:00
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
2023-02-22 12:50:25 +01:00
net/af_packet: make sure to pull mac header
2023-01-18 11:41:45 +01:00
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
2023-03-11 16:43:41 +01:00
net/rose: Fix to not accept on connected socket
2023-02-22 12:50:34 +01:00
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
2023-01-18 11:41:33 +01:00
net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
2023-04-26 11:24:01 +02:00
sctp: Call inet6_destroy_sock() via sk->sk_destruct().
2023-04-26 11:24:05 +02:00
net/smc: fix fallback failed while sendmsg with fastopen
2023-03-17 08:32:51 +01:00
sunrpc: only free unix grouplist after RCU settles
2023-04-20 12:07:33 +02:00
tipc: call tipc_lxc_xmit without holding node_read_lock
2023-01-18 11:42:06 +01:00
net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
2023-04-05 11:16:36 +02:00
af_unix: Get user_ns from in_skb in unix_diag_get_exact().
2022-12-14 11:30:44 +01:00
net: vmw_vsock: vmci: Check memcpy_from_msg()
2023-01-18 11:41:13 +01:00
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
2023-03-13 10:18:25 +01:00
net/x25: Fix to not accept on connected socket
2023-02-22 12:50:26 +01:00
xfrm: Allow transport-mode states with AF_UNSPEC selector
2023-03-22 13:28:03 +01:00
48cdcb40d5