Re: CVE Request: more tight ioctl permissions in dl2k driver

[Marcus Meissner <meissner () suse de>]

On Fri, May 04, 2012 at 09:31:44AM +0200, Marcus Meissner wrote:
> Hi,
>
> Can you please assign a CVE for this issue:
>
> Stephan Mueller reported lack of capable(CAP_NET_ADMIN) checks
> in private ioctls in the dl2k network card driver.
>
> The netdev team will probably remove the handling of the SIOCDEVPRIVATE*
> calls from this driver though and not use Jeffs patch directly.
>
> References:
>       http://www.spinics.net/lists/netdev/msg196365.html
>       http://www.spinics.net/lists/netdev/msg196381.html
>       http://www.spinics.net/lists/netdev/msg196382.html
>       https://bugzilla.novell.com/show_bug.cgi?id=758813

Missed the mainline commit reference, which is now at:

https://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=1bb57e940e1958e40d51f2078f50c3a96a9b2d75

commit 1bb57e940e1958e40d51f2078f50c3a96a9b2d75
Author: Jeff Mahoney <jeffm () suse com>
Date:   Wed Apr 25 14:32:09 2012 +0000

    dl2k: Clean up rio_ioctl
    
    The dl2k driver's rio_ioctl call has a few issues:
    - No permissions checking
    - Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
    - Has a few ioctls that may have been used for debugging at one point
      but have no place in the kernel proper.
    
    This patch removes all but the MII ioctls, renumbers them to use the
    standard ones, and adds the proper permission check for SIOCSMIIREG.
    
    We can also get rid of the dl2k-specific struct mii_data in favor of
    the generic struct mii_ioctl_data.
    
    Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
    
    Most of the MII code for the driver could probably be converted to use
    the generic MII library but I don't have a device to test the results.
    
    Reported-by: Stephan Mueller <stephan.mueller () atsec com>
    Signed-off-by: Jeff Mahoney <jeffm () suse com>
    Signed-off-by: David S. Miller <davem () davemloft net>