From 197ae757ecaee0a20e7494deca553289ae481238 Mon Sep 17 00:00:00 2001 From: Jeimon Date: Tue, 2 Jul 2024 15:06:17 +0800 Subject: [PATCH] net/nfc/rawsock.c: fix a permission check bug stable inclusion from stable-v4.19.195 commit 1e5cab50208c8fb7351b798cb1d569debfeb994a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4JW CVE: CVE-2021-47285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1e5cab50208c8fb7351b798cb1d569debfeb994a -------------------------------- [ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ] The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable(). Signed-off-by: Jeimon Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Signed-off-by: Wang Hai --- net/nfc/rawsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c index b927730d9ab0..8f8bb0263827 100644 --- a/net/nfc/rawsock.c +++ b/net/nfc/rawsock.c @@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock, return -ESOCKTNOSUPPORT; if (sock->type == SOCK_RAW) { - if (!capable(CAP_NET_RAW)) + if (!ns_capable(net->user_ns, CAP_NET_RAW)) return -EPERM; sock->ops = &rawsock_raw_ops; } else { -- Gitee