Smack: type confusion in smak sendmsg() handler 04/56704/2
authorRoman Kubiak <r.kubiak@samsung.com>
Thu, 17 Dec 2015 12:24:35 +0000 (13:24 +0100)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Tue, 12 Jan 2016 07:27:10 +0000 (16:27 +0900)
commita13624574a8615c5854aa7ecf316e8b458fba253
tree48f8c2fcac6343ba2e84a5230633f4354569a1d3
parentf6ca3cf81eaf357a62d072478dab0bafa29e7746
Smack: type confusion in smak sendmsg() handler

Smack security handler for sendmsg() syscall
is vulnerable to type confusion issue what
can allow to privilege escalation into root
or cause denial of service.

A malicious attacker can create socket of one
type for example AF_UNIX and pass is into
sendmsg() function ensuring that this is
AF_INET socket.

Remedy
Do not trust user supplied data.
Proposed fix below.

Change-Id: I6d8b3a3eb9560c0e6d6bfef59e56d6ec659e2d3d
Signed-off-by: Roman Kubiak <r.kubiak@samsung.com>
Signed-off-by: Mateusz Fruba <m.fruba@samsung.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
[Backport from linux-next of v4.5-rc]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
security/smack/smack_lsm.c