diff options
| author | kib <kib@FreeBSD.org> | 2016-06-08 04:37:03 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2016-06-08 04:37:03 +0000 |
| commit | ef4ada7b7665029bd2c1c35e80c1a18df361b214 (patch) | |
| tree | 27ad8ea462c1ee7fc8201def9481098b1209c168 /sys/kern/kern_exec.c | |
| parent | 910fd3b83d2bb18596d138c4c821005cd9342c7f (diff) | |
| download | FreeBSD-src-ef4ada7b7665029bd2c1c35e80c1a18df361b214.zip FreeBSD-src-ef4ada7b7665029bd2c1c35e80c1a18df361b214.tar.gz | |
Old process credentials for setuid execve must not be dereferenced
when the process credentials were not changed. This can happen if an
error occured trying to activate the setuid binary. And on error, if
new credentials were not yet assigned, they must be freed to not
create the leak.
Use oldcred == NULL as the predicate to detect credential
reassignment.
Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'sys/kern/kern_exec.c')
| -rw-r--r-- | sys/kern/kern_exec.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index d2de3c8..63d855d 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -806,8 +806,11 @@ interpret: /* * Set the new credentials. */ - if (imgp->newcred != NULL) + if (imgp->newcred != NULL) { proc_set_cred(p, imgp->newcred); + crfree(oldcred); + oldcred = NULL; + } /* * Store the vp for use in procfs. This vnode was referenced by namei @@ -918,8 +921,9 @@ exec_fail: SDT_PROBE1(proc, , , exec__failure, error); } - if (imgp->newcred != NULL) - crfree(oldcred); + if (imgp->newcred != NULL && oldcred != NULL) + crfree(imgp->newcred); + #ifdef MAC mac_execve_exit(imgp); mac_execve_interpreter_exit(interpvplabel); |
