| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-36963: tracefs: Reset permissions on remount if permissions are options |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| tracefs: Reset permissions on remount if permissions are options |
| |
| There's an inconsistency with the way permissions are handled in tracefs. |
| Because the permissions are generated when accessed, they default to the |
| root inode's permission if they were never set by the user. If the user |
| sets the permissions, then a flag is set and the permissions are saved via |
| the inode (for tracefs files) or an internal attribute field (for |
| eventfs). |
| |
| But if a remount happens that specify the permissions, all the files that |
| were not changed by the user gets updated, but the ones that were are not. |
| If the user were to remount the file system with a given permission, then |
| all files and directories within that file system should be updated. |
| |
| This can cause security issues if a file's permission was updated but the |
| admin forgot about it. They could incorrectly think that remounting with |
| permissions set would update all files, but miss some. |
| |
| For example: |
| |
| # cd /sys/kernel/tracing |
| # chgrp 1002 current_tracer |
| # ls -l |
| [..] |
| -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb |
| -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb |
| -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb |
| -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer |
| -rw-r----- 1 root root 0 May 1 21:25 dynamic_events |
| -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info |
| -r--r----- 1 root root 0 May 1 21:25 enabled_functions |
| |
| Where current_tracer now has group "lkp". |
| |
| # mount -o remount,gid=1001 . |
| # ls -l |
| -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb |
| -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb |
| -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb |
| -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer |
| -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events |
| -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info |
| -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions |
| |
| Everything changed but the "current_tracer". |
| |
| Add a new link list that keeps track of all the tracefs_inodes which has |
| the permission flags that tell if the file/dir should use the root inode's |
| permission or not. Then on remount, clear all the flags so that the |
| default behavior of using the root inode's permission is done for all |
| files and directories. |
| |
| The Linux kernel CVE team has assigned CVE-2024-36963 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.6.18 with commit 628adb842bd5e1c2c598534a7a022b8235289de6 and fixed in 6.6.31 with commit 5f91fc82794d4a6e41cdcd02d00baa377d94ca78 |
| Issue introduced in 6.8 with commit 8186fff7ab649085e2c60d032d9a20a85af1d87c and fixed in 6.8.10 with commit 414fb08628143203d29ccd0264b5a83fb9523c03 |
| Issue introduced in 6.8 with commit 8186fff7ab649085e2c60d032d9a20a85af1d87c and fixed in 6.9 with commit baa23a8d4360d981a49913841a726edede5cdd54 |
| Issue introduced in 6.7.4 with commit 9c2ac5e0ea7899411fd900d4681890722a020735 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-36963 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/tracefs/event_inode.c |
| fs/tracefs/inode.c |
| fs/tracefs/internal.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78 |
| https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03 |
| https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54 |
