Home Home > GIT Browse > SLE12-SP5-UPDATE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBorislav Petkov <bp@suse.de>2019-10-16 17:22:00 +0200
committerBorislav Petkov <bp@suse.de>2019-10-16 17:22:00 +0200
commiteaf7ef5544ff4da942da87e57d1d873333f64ed3 (patch)
treed84650e95c3d2b9ee77100f00d9ec56e0a0779a1
parent158e9eaf8280863dec07184308a92da137d45ae7 (diff)
nfc: enforce CAP_NET_RAW for raw sockets (bsc#1152788
CVE-2019-17056). suse-commit: 6bf43c02a38978453a3c51da0bb9947e98554ffc
-rw-r--r--net/nfc/llcp_sock.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index fb7afcaa3004..33ad7e25a89d 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -1012,10 +1012,13 @@ static int llcp_sock_create(struct net *net, struct socket *sock,
sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT;
- if (sock->type == SOCK_RAW)
+ if (sock->type == SOCK_RAW) {
+ if (!capable(CAP_NET_RAW))
+ return -EPERM;
sock->ops = &llcp_rawsock_ops;
- else
+ } else {
sock->ops = &llcp_sock_ops;
+ }
sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern);
if (sk == NULL)