diff options
author | Ronny Chevalier <ronny.chevalier@hp.com> | 2018-07-11 14:39:37 +0200 |
---|---|---|
committer | Paul Moore <paul@paul-moore.com> | 2018-07-18 11:43:36 -0400 |
commit | baa2a4fdd525c8c4b0f704d20457195b29437839 (patch) | |
tree | 3f84ac6375623358fb1bfe69fd3c97a51de7f169 /lib | |
parent | 290e44b7dd116cc61cf37b7ca0be13313bb11e37 (diff) |
audit: fix use-after-free in audit_add_watch
audit_add_watch stores locally krule->watch without taking a reference
on watch. Then, it calls audit_add_to_parent, and uses the watch stored
locally.
Unfortunately, it is possible that audit_add_to_parent updates
krule->watch.
When it happens, it also drops a reference of watch which
could free the watch.
How to reproduce (with KASAN enabled):
auditctl -w /etc/passwd -F success=0 -k test_passwd
auditctl -w /etc/passwd -F success=1 -k test_passwd2
The second call to auditctl triggers the use-after-free, because
audit_to_parent updates krule->watch to use a previous existing watch
and drops the reference to the newly created watch.
To fix the issue, we grab a reference of watch and we release it at the
end of the function.
Signed-off-by: Ronny Chevalier <ronny.chevalier@hp.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions