Received-SPF: pass (google.com: domain of linux-kernel+bounces-79178-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <20240223190546.3329966-1-mic@digikod.net> <20240223190546.3329966-2-mic@digikod.net>
In-Reply-To: <20240223190546.3329966-2-mic@digikod.net>
From: Paul Moore <paul@paul-moore.com>
Date: Fri, 23 Feb 2024 16:07:18 -0500
Message-ID: <CAHC9VhQGLmeL4Buh3ZzS3LuZ9Grut9s7KEq2q04DYUMCftrVkg@mail.gmail.com>
Subject: Re: [PATCH 2/2] AppArmor: Fix lsm_get_self_attr()
To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= <mic@digikod.net>
Cc: Casey Schaufler <casey@schaufler-ca.com>, John Johansen <john.johansen@canonical.com>, 
	James Morris <jmorris@namei.org>, "Serge E . Hallyn" <serge@hallyn.com>, linux-kernel@vger.kernel.org, 
	linux-security-module@vger.kernel.org, stable@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 23, 2024 at 2:06=E2=80=AFPM Micka=C3=ABl Sala=C3=BCn <mic@digik=
od.net> wrote:
>
> aa_getprocattr() may not initialize the value's pointer in some case.
> As for proc_pid_attr_read(), initialize this pointer to NULL in
> apparmor_getselfattr() to avoid an UAF in the kfree() call.
>
> Cc: Casey Schaufler <casey@schaufler-ca.com>
> Cc: John Johansen <john.johansen@canonical.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: stable@vger.kernel.org
> Fixes: 223981db9baf ("AppArmor: Add selfattr hooks")
> Signed-off-by: Micka=C3=ABl Sala=C3=BCn <mic@digikod.net>
> ---
>  security/apparmor/lsm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

If you like John, I can send this up to Linus with the related SELinux
fix, I would just need an ACK from you.

> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index 98e1150bee9d..9a3dcaafb5b1 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -784,7 +784,7 @@ static int apparmor_getselfattr(unsigned int attr, st=
ruct lsm_ctx __user *lx,
>         int error =3D -ENOENT;
>         struct aa_task_ctx *ctx =3D task_ctx(current);
>         struct aa_label *label =3D NULL;
> -       char *value;
> +       char *value =3D NULL;
>
>         switch (attr) {
>         case LSM_ATTR_CURRENT:
> --
> 2.43.0

--=20
paul-moore.com