[<prev] [next>] [day] [month] [year] [list]
Message-ID: <deba4116-70d2-0d08-4e80-ca8da698d5ec@linux.vnet.ibm.com>
Date: Tue, 6 Jul 2021 19:16:00 -0400
From: Nayna <nayna@...ux.vnet.ibm.com>
To: oss-security@...ts.openwall.com
Cc: George Wilson <gcwilson@...ux.ibm.com>, Mimi Zohar <zohar@...ux.ibm.com>,
naynjain@....com
Subject: CVE-2021-35039: Linux kernel loading unsigned kernel modules via
init_module syscall
Vulnerability: Linux Kernel loading unsigned kernel modules via
init_module syscall
Fixes: 7c9bc0983f89 ("ima: check signature enforcement against cmdline
param instead of CONFIG")
Commit: 0c18f29aae7c ("module: limit enabling module.sig_enforce")
CVE: CVE-2021-35039
Details:
The IMA arch specific policy rules, when enabled on x86, arm or powerpc,
kernels with IMA_APPRAISE_REQUIRE_MODULE_SIGS configured, or systems
with custom IMA policies containing a similar module rule, require all
kernel modules to be signed. IMA, currently, only verifies kernel module
signatures loaded via finit_module and relies on CONFIG_MODULE_SIG to
verify kernel modules signatures loaded via init_module. The patch
addresses the situation where MODULE_SIG is not enabled, but
"module.sig_enforce=1" is specified on the boot command line.
Affected Kernel Versions: 4.15 through 5.12
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
