Commit d496f94d authored by Alan Cox's avatar Alan Cox Committed by James Bottomley
Browse files

[SCSI] aacraid: fix security weakness



Actually there are several but one is trivially fixed

1.	FSACTL_GET_NEXT_ADAPTER_FIB ioctl does not lock dev->fib_list
but needs to
2.	Ditto for FSACTL_CLOSE_GET_ADAPTER_FIB
3.	It is possible to construct an attack via the SRB ioctls where
the user obtains assorted elevated privileges. Various approaches are
possible, the trivial ones being things like writing to the raw media
via scsi commands and the swap image of other executing programs with
higher privileges.

So the ioctls should be CAP_SYS_RAWIO - at least all the FIB manipulating
ones. This is a bandaid fix for #3 but probably the ioctls should grow
their own capable checks. The other two bugs need someone competent in that
driver to fix them.
Signed-off-by: default avatarAlan Cox <alan@redhat.com>
Signed-off-by: default avatarMark Salyzyn <aacraid@adaptec.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent 3ace426f
...@@ -517,6 +517,8 @@ static struct device_attribute *aac_dev_attrs[] = { ...@@ -517,6 +517,8 @@ static struct device_attribute *aac_dev_attrs[] = {
static int aac_ioctl(struct scsi_device *sdev, int cmd, void __user * arg) static int aac_ioctl(struct scsi_device *sdev, int cmd, void __user * arg)
{ {
struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata; struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
return aac_do_ioctl(dev, cmd, arg); return aac_do_ioctl(dev, cmd, arg);
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment