Vulnerability: The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modify the dmesg_restrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as demonstrated by a root user in a Linux Containers (aka LXC) environment.
Vulnerability ID: CVE-2011-4080
CWE: CWE-264
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: kernel/sysctl.c
Commit message: sysctl: restrict write access to dmesg_restrict

When dmesg_restrict is set to 1 CAP_SYS_ADMIN is needed to read the kernel
ring buffer.  But a root user without CAP_SYS_ADMIN is able to reset
dmesg_restrict to 0.

This is an issue when e.g.  LXC (Linux Containers) are used and complete
user space is running without CAP_SYS_ADMIN.  A unprivileged and jailed
root user can bypass the dmesg_restrict protection.

With this patch writing to dmesg_restrict is only allowed when root has
CAP_SYS_ADMIN.

Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Serge E. Hallyn <serge@hallyn.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Kees Cook <kees.cook@canonical.com>
Cc: James Morris <jmorris@namei.org>
Cc: Eugene Teo <eugeneteo@kernel.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Richard Weinberger

Vulnerable version (before fix):
 static int proc_taint(struct ctl_table *table, int write, 			       void __user *buffer, size_t *lenp, loff_t *ppos); #endif  #ifdef CONFIG_MAGIC_SYSRQ /* Note: sysrq code uses it's own private copy */ static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE; static struct ctl_table kern_table[] = { 		.data		= &kptr_restrict, 		.maxlen		= sizeof(int), 		.mode		= 0644, 		.proc_handler	= proc_dointvec_minmax, 		.extra1		= &zero, 		.extra2		= &two, 	}, static int proc_taint(struct ctl_table *table, int write, 	return err; }  struct do_proc_dointvec_minmax_conv_param { 	int *min; 	int *max;

Fixed version (after fix):
 static int proc_taint(struct ctl_table *table, int write, 			       void __user *buffer, size_t *lenp, loff_t *ppos); #endif  #ifdef CONFIG_PRINTK static int proc_dmesg_restrict(struct ctl_table *table, int write, 				void __user *buffer, size_t *lenp, loff_t *ppos); #endif  #ifdef CONFIG_MAGIC_SYSRQ /* Note: sysrq code uses it's own private copy */ static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE; static struct ctl_table kern_table[] = { 		.data		= &kptr_restrict, 		.maxlen		= sizeof(int), 		.mode		= 0644, 		.proc_handler	= proc_dmesg_restrict, 		.extra1		= &zero, 		.extra2		= &two, 	}, static int proc_taint(struct ctl_table *table, int write, 	return err; }  #ifdef CONFIG_PRINTK static int proc_dmesg_restrict(struct ctl_table *table, int write, 				void __user *buffer, size_t *lenp, loff_t *ppos) { 	if (write && !capable(CAP_SYS_ADMIN)) 		return -EPERM;  	return proc_dointvec_minmax(table, write, buffer, lenp, ppos); } #endif  struct do_proc_dointvec_minmax_conv_param { 	int *min; 	int *max;

Patch:
patch: @@ -170,6 +170,11 @@ static int proc_taint(struct ctl_table *table, int write,
 			       void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
 
+#ifdef CONFIG_PRINTK
+static int proc_dmesg_restrict(struct ctl_table *table, int write,
+				void __user *buffer, size_t *lenp, loff_t *ppos);
+#endif
+
 #ifdef CONFIG_MAGIC_SYSRQ
 /* Note: sysrq code uses it's own private copy */
 static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
@@ -707,7 +712,7 @@ static struct ctl_table kern_table[] = {
 		.data		= &kptr_restrict,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec_minmax,
+		.proc_handler	= proc_dmesg_restrict,
 		.extra1		= &zero,
 		.extra2		= &two,
 	},
@@ -2394,6 +2399,17 @@ static int proc_taint(struct ctl_table *table, int write,
 	return err;
 }
 
+#ifdef CONFIG_PRINTK
+static int proc_dmesg_restrict(struct ctl_table *table, int write,
+				void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (write && !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+}
+#endif
+
 struct do_proc_dointvec_minmax_conv_param {
 	int *min;
 	int *max;
path: kernel/sysctl.c