Ruihan Li 47e6893a5b bluetooth: Perform careful capability checks in hci_sock_ioctl() ... commit 25c150ac103a4ebeed0319994c742a90634ddf18 upstream. Previously, capability was checked using capable(), which verified that the caller of the ioctl system call had the required capability. In addition, the result of the check would be stored in the HCI_SOCK_TRUSTED flag, making it persistent for the socket. However, malicious programs can abuse this approach by deliberately sharing an HCI socket with a privileged task. The HCI socket will be marked as trusted when the privileged task occasionally makes an ioctl call. This problem can be solved by using sk_capable() to check capability, which ensures that not only the current task but also the socket opener has the specified capability, thus reducing the risk of privilege escalation through the previously identified vulnerability. Cc: stable@vger.kernel.org Fixes: f81f5b2db8 ("Bluetooth: Send control open and close messages for HCI raw sockets") Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-05-01 08:26:27 +09:00
..
6lowpan	net: 6lowpan: constify lowpan_nhc structures	2022-06-09 21:53:28 +02:00
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:35:08 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
appletalk
atm	net/atm: fix proc_mpc_write incorrect return value	2022-10-15 11:08:36 +01:00
ax25	ax25: move from strlcpy with unused retval to strscpy	2022-08-22 17:55:50 -07:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-09-22 13:02:10 -07:00
bluetooth	bluetooth: Perform careful capability checks in hci_sock_ioctl()	2023-05-01 08:26:27 +09:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter
bridge	net: bridge: switchdev: don't notify FDB entries with "master dynamic"	2023-04-26 14:28:35 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos	2023-04-13 16:55:33 +02:00
ceph	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
core	skbuff: Fix a race between coalescing and releasing SKBs	2023-04-20 12:35:10 +02:00
dcb
dccp	dccp: Call inet6_destroy_sock() via sk->sk_destruct().	2023-04-26 14:28:43 +02:00
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix daisy-chained switches	2023-03-30 12:49:09 +02:00
ethernet	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
ethtool	ethtool: reset #lanes when lanes is omitted	2023-04-13 16:55:24 +02:00
hsr	hsr: ratelimit only when errors are printed	2023-04-06 12:10:58 +02:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife
ipv4	tcp: restrict net.ipv4.tcp_app_win	2023-04-20 12:35:08 +02:00
ipv6	dccp: Call inet6_destroy_sock() via sk->sk_destruct().	2023-04-26 14:28:43 +02:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	xfrm: Fix oops in __xfrm_state_delete()	2022-11-22 07:14:55 +01:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 14:28:43 +02:00
l3mdev
lapb
llc	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
mac80211	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta	2023-04-13 16:55:19 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 08:06:34 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	mptcp: fix accept vs worker race	2023-05-01 08:26:27 +09:00
ncsi	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netfilter	netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements	2023-04-26 14:28:34 +02:00
netlabel	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink	netlink: annotate lockless accesses to nlk->max_recvmsg_len	2023-04-13 16:55:24 +02:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-02-09 11:28:06 +01:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-17 08:50:17 +01:00
nsh
openvswitch	net: openvswitch: fix race on port output	2023-04-20 12:35:09 +02:00
packet	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE	2022-11-29 08:30:18 -08:00
phonet
psample	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:33:02 +01:00
rfkill
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:59:42 +01:00
rxrpc	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()	2022-12-31 13:32:55 +01:00
sched	net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg	2023-04-26 14:28:32 +02:00
sctp	sctp: Call inet6_destroy_sock() via sk->sk_destruct().	2023-04-26 14:28:43 +02:00
smc	net/smc: fix deadlock triggered by cancel_delayed_work_syn()	2023-03-22 13:33:47 +01:00
strparser	strparser: pad sk_skb_cb to avoid straddling cachelines	2022-07-08 18:38:44 -07:00
sunrpc	sunrpc: only free unix grouplist after RCU settles	2023-04-13 16:55:23 +02:00
switchdev	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
tipc	tipc: fix kernel warning when sending SYN message	2023-02-22 12:59:53 +01:00
tls	net: tls: fix device-offloaded sendpage straddling records	2023-03-17 08:50:26 +01:00
unix	af_unix: fix struct pid leaks in OOB support	2023-03-17 08:50:28 +01:00
vmw_vsock	net: vmw_vsock: vmci: Check memcpy_from_msg()	2022-12-31 13:32:26 +01:00
wireless	wifi: cfg80211: fix MLO connection ownership	2023-03-22 13:33:43 +01:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	xsk: Add missing overflow check in xdp_umem_reg	2023-03-30 12:49:02 +02:00
xfrm	xfrm: Zero padding when dumping algos and encap	2023-04-06 12:10:37 +02:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
socket.c	net: avoid double iput when sock_alloc_file fails	2023-03-10 09:34:34 +01:00
sysctl_net.c