rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3234
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/rose/af_rose.c
Commit message: rose: fix info leak via msg_name in rose_recvmsg()

The code in rose_recvmsg() does not initialize all of the members of
struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.
Nor does it initialize the padding bytes of the structure inserted by
the compiler for alignment. This will lead to leaking uninitialized
kernel stack bytes in net/socket.c.

Fix the issue by initializing the memory used for sockaddr info with
memset(0).

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int rose_recvmsg(struct kiocb *iocb, struct socket *sock, 	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);  	if (srose != NULL) { 		srose->srose_family = AF_ROSE; 		srose->srose_addr   = rose->dest_addr; 		srose->srose_call   = rose->dest_call;

Fixed version (after fix):
 static int rose_recvmsg(struct kiocb *iocb, struct socket *sock, 	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);  	if (srose != NULL) { 		memset(srose, 0, msg->msg_namelen); 		srose->srose_family = AF_ROSE; 		srose->srose_addr   = rose->dest_addr; 		srose->srose_call   = rose->dest_call;

Patch:
patch: @@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
 	if (srose != NULL) {
+		memset(srose, 0, msg->msg_namelen);
 		srose->srose_family = AF_ROSE;
 		srose->srose_addr   = rose->dest_addr;
 		srose->srose_call   = rose->dest_call;
path: net/rose/af_rose.c
Vulnerability: The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3236
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/vmw_vsock/vmci_transport.c
Commit message: VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue()

In case we received no data on the call to skb_recv_datagram(), i.e.
skb->data is NULL, vmci_transport_dgram_dequeue() will return with 0
without updating msg_namelen leading to net/socket.c leaking the local,
uninitialized sockaddr_storage variable to userland -- 128 bytes of
kernel stack memory.

Fix this by moving the already existing msg_namelen assignment a few
lines above.

Cc: Andy King <acking@vmware.com>
Cc: Dmitry Torokhov <dtor@vmware.com>
Cc: George Zhang <georgezhang@vmware.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int vmci_transport_dgram_dequeue(struct kiocb *kiocb, 	if (flags & MSG_OOB || flags & MSG_ERRQUEUE) 		return -EOPNOTSUPP;  	/* Retrieve the head sk_buff from the socket's receive queue. */ 	err = 0; 	skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err); static int vmci_transport_dgram_dequeue(struct kiocb *kiocb, 	if (err) 		goto out;  	msg->msg_namelen = 0; 	if (msg->msg_name) { 		struct sockaddr_vm *vm_addr; 

Fixed version (after fix):
 static int vmci_transport_dgram_dequeue(struct kiocb *kiocb, 	if (flags & MSG_OOB || flags & MSG_ERRQUEUE) 		return -EOPNOTSUPP;  	msg->msg_namelen = 0;  	/* Retrieve the head sk_buff from the socket's receive queue. */ 	err = 0; 	skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err); static int vmci_transport_dgram_dequeue(struct kiocb *kiocb, 	if (err) 		goto out;  	if (msg->msg_name) { 		struct sockaddr_vm *vm_addr; 

Patch:
patch: @@ -1736,6 +1736,8 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
 	if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
 		return -EOPNOTSUPP;
 
+	msg->msg_namelen = 0;
+
 	/* Retrieve the head sk_buff from the socket's receive queue. */
 	err = 0;
 	skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
@@ -1768,7 +1770,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
 	if (err)
 		goto out;
 
-	msg->msg_namelen = 0;
 	if (msg->msg_name) {
 		struct sockaddr_vm *vm_addr;
path: net/vmw_vsock/vmci_transport.c
Vulnerability: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Vulnerability ID: CVE-2013-3237
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-22
File: net/vmw_vsock/af_vsock.c
Commit message: VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg()

The code misses to update the msg_namelen member to 0 and therefore
makes net/socket.c leak the local, uninitialized sockaddr_storage
variable to userland -- 128 bytes of kernel stack memory.

Cc: Andy King <acking@vmware.com>
Cc: Dmitry Torokhov <dtor@vmware.com>
Cc: George Zhang <georgezhang@vmware.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 vsock_stream_recvmsg(struct kiocb *kiocb, 	vsk = vsock_sk(sk); 	err = 0;  	lock_sock(sk);  	if (sk->sk_state != SS_CONNECTED) {

Fixed version (after fix):
 vsock_stream_recvmsg(struct kiocb *kiocb, 	vsk = vsock_sk(sk); 	err = 0;  	msg->msg_namelen = 0;  	lock_sock(sk);  	if (sk->sk_state != SS_CONNECTED) {

Patch:
patch: @@ -1670,6 +1670,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
 	vsk = vsock_sk(sk);
 	err = 0;
 
+	msg->msg_namelen = 0;
+
 	lock_sock(sk);
 
 	if (sk->sk_state != SS_CONNECTED) {
path: net/vmw_vsock/af_vsock.c
Vulnerability: Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
Vulnerability ID: CVE-2013-3527
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/vanillaforums/Garden
Published: 2013-05-10
File: library/database/class.sqldriver.php
Commit message: Disable the ability to call functions in escaped sql strings.
Commit author: Todd Burry

Vulnerable version (before fix):
 public function ConditionExpr($Field, $Value, $EscapeFieldSql = TRUE, $EscapeVal          $Field = '@' . $Field;       }       if(is_array($Value)) {          $FunctionCall = array_keys($Value);          $FunctionCall = $FunctionCall[0];          $FunctionArg = $Value[$FunctionCall];

Fixed version (after fix):
 public function ConditionExpr($Field, $Value, $EscapeFieldSql = TRUE, $EscapeVal          $Field = '@' . $Field;       }       if(is_array($Value)) {          //$ValueStr = var_export($Value, TRUE);          $ValueStr = 'ARRAY';          Deprecated("Gdn_SQL->ConditionExpr(VALUE, {$ValueStr})", 'Gdn_SQL->ConditionExpr(VALUE, VALUE)');                    if ($EscapeValueSql)             throw new Gdn_UserException('Invalid function call.');                    $FunctionCall = array_keys($Value);          $FunctionCall = $FunctionCall[0];          $FunctionArg = $Value[$FunctionCall];

Patch:
patch: @@ -309,6 +309,13 @@ public function ConditionExpr($Field, $Value, $EscapeFieldSql = TRUE, $EscapeVal
          $Field = '@' . $Field;
       }
       if(is_array($Value)) {
+         //$ValueStr = var_export($Value, TRUE);
+         $ValueStr = 'ARRAY';
+         Deprecated("Gdn_SQL->ConditionExpr(VALUE, {$ValueStr})", 'Gdn_SQL->ConditionExpr(VALUE, VALUE)');
+         
+         if ($EscapeValueSql)
+            throw new Gdn_UserException('Invalid function call.');
+         
          $FunctionCall = array_keys($Value);
          $FunctionCall = $FunctionCall[0];
          $FunctionArg = $Value[$FunctionCall];
path: library/database/class.sqldriver.php
Vulnerability: Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
Vulnerability ID: CVE-2013-3742
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2013-07-04
File: view_create.php
Commit message: escape query in error message
Commit author: Dieter Adriaenssens

Vulnerable version (before fix):
             $response->addJSON(                 'message',                 PMA_Message::error(                     "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()                 )             );             $response->isSuccess(false);

Fixed version (after fix):
             $response->addJSON(                 'message',                 PMA_Message::error(                     "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"                     . PMA_DBI_getError()                 )             );             $response->isSuccess(false);

Patch:
patch: @@ -114,7 +114,8 @@
             $response->addJSON(
                 'message',
                 PMA_Message::error(
-                    "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()
+                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
+                    . PMA_DBI_getError()
                 )
             );
             $response->isSuccess(false);
path: view_create.php
Vulnerability: Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare call.
Vulnerability ID: CVE-2013-4205
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-08-25
File: kernel/user_namespace.c
Commit message: userns: unshare_userns(&cred) should not populate cred on failure

unshare_userns(new_cred) does *new_cred = prepare_creds() before
create_user_ns() which can fail. However, the caller expects that
it doesn't need to take care of new_cred if unshare_userns() fails.

We could change the single caller, sys_unshare(), but I think it
would be more clean to avoid the side effects on failure, so with
this patch unshare_userns() does put_cred() itself and initializes
*new_cred only if create_user_ns() succeeeds.

Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Oleg Nesterov

Vulnerable version (before fix):
 int create_user_ns(struct cred *new) int unshare_userns(unsigned long unshare_flags, struct cred **new_cred) { 	struct cred *cred;  	if (!(unshare_flags & CLONE_NEWUSER)) 		return 0;  	cred = prepare_creds(); 	if (!cred) 		return -ENOMEM;  	*new_cred = cred; 	return create_user_ns(cred); }  void free_user_ns(struct user_namespace *ns)

Fixed version (after fix):
 int create_user_ns(struct cred *new) int unshare_userns(unsigned long unshare_flags, struct cred **new_cred) { 	struct cred *cred; 	int err = -ENOMEM;  	if (!(unshare_flags & CLONE_NEWUSER)) 		return 0;  	cred = prepare_creds(); 	if (cred) { 		err = create_user_ns(cred); 		if (err) 			put_cred(cred); 		else 			*new_cred = cred; 	}  	return err; }  void free_user_ns(struct user_namespace *ns)

Patch:
patch: @@ -105,16 +105,21 @@ int create_user_ns(struct cred *new)
 int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
 {
 	struct cred *cred;
+	int err = -ENOMEM;
 
 	if (!(unshare_flags & CLONE_NEWUSER))
 		return 0;
 
 	cred = prepare_creds();
-	if (!cred)
-		return -ENOMEM;
+	if (cred) {
+		err = create_user_ns(cred);
+		if (err)
+			put_cred(cred);
+		else
+			*new_cred = cred;
+	}
 
-	*new_cred = cred;
-	return create_user_ns(cred);
+	return err;
 }
 
 void free_user_ns(struct user_namespace *ns)
path: kernel/user_namespace.c
Vulnerability: Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length.
Vulnerability ID: CVE-2013-4247
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-08-25
File: fs/cifs/connect.c
Commit message: cifs: fix off-by-one bug in build_unc_path_to_root

commit 839db3d10a (cifs: fix up handling of prefixpath= option) changed
the code such that the vol->prepath no longer contained a leading
delimiter and then fixed up the places that accessed that field to
account for that change.

One spot in build_unc_path_to_root was missed however. When doing the
pointer addition on pos, that patch failed to account for the fact that
we had already incremented "pos" by one when adding the length of the
prepath. This caused a buffer overrun by one byte.

This patch fixes the problem by correcting the handling of "pos".

Cc: <stable@vger.kernel.org> # v3.8+
Reported-by: Marcus Moeller <marcus.moeller@gmx.ch>
Reported-by: Ken Fallon <ken.fallon@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Commit author: Jeff Layton

Vulnerable version (before fix):
 build_unc_path_to_root(const struct smb_vol *vol, 	pos = full_path + unc_len;  	if (pplen) { 		*pos++ = CIFS_DIR_SEP(cifs_sb); 		strncpy(pos, vol->prepath, pplen); 		pos += pplen; 	} 

Fixed version (after fix):
 build_unc_path_to_root(const struct smb_vol *vol, 	pos = full_path + unc_len;  	if (pplen) { 		*pos = CIFS_DIR_SEP(cifs_sb); 		strncpy(pos + 1, vol->prepath, pplen); 		pos += pplen; 	} 

Patch:
patch: @@ -3279,8 +3279,8 @@ build_unc_path_to_root(const struct smb_vol *vol,
 	pos = full_path + unc_len;
 
 	if (pplen) {
-		*pos++ = CIFS_DIR_SEP(cifs_sb);
-		strncpy(pos, vol->prepath, pplen);
+		*pos = CIFS_DIR_SEP(cifs_sb);
+		strncpy(pos + 1, vol->prepath, pplen);
 		pos += pplen;
 	}
path: fs/cifs/connect.c
Vulnerability: The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.
Vulnerability ID: CVE-2013-4254
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-08-25
File: arch/arm/kernel/perf_event.c
Commit message: ARM: 7809/1: perf: fix event validation for software group leaders

It is possible to construct an event group with a software event as a
group leader and then subsequently add a hardware event to the group.
This results in the event group being validated by adding all members
of the group to a fake PMU and attempting to allocate each event on
their respective PMU.

Unfortunately, for software events wthout a corresponding arm_pmu, this
results in a kernel crash attempting to dereference the ->get_event_idx
function pointer.

This patch fixes the problem by checking explicitly for software events
and ignoring those in event validation (since they can always be
scheduled). We will probably want to revisit this for 3.12, since the
validation checks don't appear to work correctly when dealing with
multiple hardware PMUs anyway.

Cc: <stable@vger.kernel.org>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Commit author: Will Deacon

Vulnerable version (before fix):
 validate_event(struct pmu_hw_events *hw_events, 	struct arm_pmu *armpmu = to_arm_pmu(event->pmu); 	struct pmu *leader_pmu = event->group_leader->pmu;  	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF) 		return 1; 

Fixed version (after fix):
 validate_event(struct pmu_hw_events *hw_events, 	struct arm_pmu *armpmu = to_arm_pmu(event->pmu); 	struct pmu *leader_pmu = event->group_leader->pmu;  	if (is_software_event(event)) 		return 1;  	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF) 		return 1; 

Patch:
patch: @@ -253,6 +253,9 @@ validate_event(struct pmu_hw_events *hw_events,
 	struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
 	struct pmu *leader_pmu = event->group_leader->pmu;
 
+	if (is_software_event(event))
+		return 1;
+
 	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
 		return 1;
path: arch/arm/kernel/perf_event.c
Vulnerability: The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
Vulnerability ID: CVE-2013-4264
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-11-23
File: libavcodec/g2meet.c
Commit message: avcodec/g2meet: fix src pointer checks in kempf_decode_tile()

Fixes Ticket2842

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,         return 0;     zsize = (src[0] << 8) | src[1]; src += 2;      if (src_end - src < zsize)         return AVERROR_INVALIDDATA;      ret = uncompress(c->kempf_buf, &dlen, src, zsize); static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,     for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {         for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {             if (!bits) {                 bitbuf = *src++;                 bits   = 8;             }

Fixed version (after fix):
 static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,         return 0;     zsize = (src[0] << 8) | src[1]; src += 2;      if (src_end - src < zsize + (sub_type != 2))         return AVERROR_INVALIDDATA;      ret = uncompress(c->kempf_buf, &dlen, src, zsize); static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,     for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {         for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {             if (!bits) {                 if (src >= src_end)                     return AVERROR_INVALIDDATA;                 bitbuf = *src++;                 bits   = 8;             }

Patch:
patch: @@ -389,7 +389,7 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
         return 0;
     zsize = (src[0] << 8) | src[1]; src += 2;
 
-    if (src_end - src < zsize)
+    if (src_end - src < zsize + (sub_type != 2))
         return AVERROR_INVALIDDATA;
 
     ret = uncompress(c->kempf_buf, &dlen, src, zsize);
@@ -411,6 +411,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
     for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {
         for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {
             if (!bits) {
+                if (src >= src_end)
+                    return AVERROR_INVALIDDATA;
                 bitbuf = *src++;
                 bits   = 8;
             }
path: libavcodec/g2meet.c
Vulnerability: The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Vulnerability ID: CVE-2013-4270
CWE: CWE-20
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2013-12-09
File: net/sysctl_net.c
Commit message: net: Update the sysctl permissions handler to test effective uid/gid

Modify the code to use current_euid(), and in_egroup_p, as in done
in fs/proc/proc_sysctl.c:test_perm()

Cc: stable@vger.kernel.org
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reported-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Eric W. Biederman

Vulnerable version (before fix):
 static int net_ctl_permissions(struct ctl_table_header *head,  	/* Allow network administrator to have same access as root. */ 	if (ns_capable(net->user_ns, CAP_NET_ADMIN) || 	    uid_eq(root_uid, current_uid())) { 		int mode = (table->mode >> 6) & 7; 		return (mode << 6) | (mode << 3) | mode; 	} 	/* Allow netns root group to have the same access as the root group */ 	if (gid_eq(root_gid, current_gid())) { 		int mode = (table->mode >> 3) & 7; 		return (mode << 3) | mode; 	}

Fixed version (after fix):
 static int net_ctl_permissions(struct ctl_table_header *head,  	/* Allow network administrator to have same access as root. */ 	if (ns_capable(net->user_ns, CAP_NET_ADMIN) || 	    uid_eq(root_uid, current_euid())) { 		int mode = (table->mode >> 6) & 7; 		return (mode << 6) | (mode << 3) | mode; 	} 	/* Allow netns root group to have the same access as the root group */ 	if (in_egroup_p(root_gid)) { 		int mode = (table->mode >> 3) & 7; 		return (mode << 3) | mode; 	}

Patch:
patch: @@ -47,12 +47,12 @@ static int net_ctl_permissions(struct ctl_table_header *head,
 
 	/* Allow network administrator to have same access as root. */
 	if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-	    uid_eq(root_uid, current_uid())) {
+	    uid_eq(root_uid, current_euid())) {
 		int mode = (table->mode >> 6) & 7;
 		return (mode << 6) | (mode << 3) | mode;
 	}
 	/* Allow netns root group to have the same access as the root group */
-	if (gid_eq(root_gid, current_gid())) {
+	if (in_egroup_p(root_gid)) {
 		int mode = (table->mode >> 3) & 7;
 		return (mode << 3) | mode;
 	}
path: net/sysctl_net.c
Vulnerability: The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain privileges via PID spoofing.
Vulnerability ID: CVE-2013-4300
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-09-25
File: net/core/scm.c
Commit message: net: Check the correct namespace when spoofing pid over SCM_RIGHTS

This is a security bug.

The follow-up will fix nsproxy to discourage this type of issue from
happening again.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Andy Lutomirski

Vulnerable version (before fix):
 static __inline__ int scm_check_creds(struct ucred *creds) 		return -EINVAL;  	if ((creds->pid == task_tgid_vnr(current) || 	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) && 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) || 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) && 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||

Fixed version (after fix):
 static __inline__ int scm_check_creds(struct ucred *creds) 		return -EINVAL;  	if ((creds->pid == task_tgid_vnr(current) || 	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) || 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) && 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||

Patch:
patch: @@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
 		return -EINVAL;
 
 	if ((creds->pid == task_tgid_vnr(current) ||
-	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
+	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
path: net/core/scm.c