248 lines
13 KiB
JSON
248 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-93191",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-17T16:02:15.092Z",
|
|
"datePublished": "2026-09-17T16:12:15.765Z",
|
|
"dateUpdated": "2026-10-19T09:07:03.807Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:07:03.807Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix incorrect task context in smack_msg_queue_msgrcv\n\nThe smack_msg_queue_msgrcv() function incorrectly checks\nthe permissions of the 'current' task instead of the\n'target' task.\n\nIn the msgsnd() syscall path, if a receiver is already waiting,\nthe pipelined_send() optimization is used to push the message\ndirectly to the receiver task:\n\n ipc/msg.c`pipelined_send():\n ` smp_store_release(&msr->r_msg, msg)\n\nIn this case, the 'sender' (current) task performs the check\non behalf of the 'receiver' task (msr->r_tsk, passed as the\n'target' parameter):\n\n ipc/msg.c`pipelined_send():\n ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,)\n\nHowever, smack_msg_queue_msgrcv() ignores the 'target' and\nchecks 'current':\n\n smack_msg_queue_msgrcv(…)\n ` smk_curacc_msq(isp, MAY_READWRITE); // current task\n\n'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement,\nbut 'target' (the receiver task) might NOT;\nas a result, an unauthorized receiver gets the message,\nviolating MAC policy.\n\nTest:\n1) create a sysv message queue with label “foo”\n2) echo \"bar foo r\" >/smack/load2\n3) msgrcv(,,,0,MSG_NOERROR) in \"bar\"-labeled task.\n The task is waiting for the messages ...\n4) msgsnd() from a \"foo\"-labeled task:\n\"bar\"-labeled task gets the message.\n\nThis patch fixes the issue by checking permission on the\n'target' task instead of 'current'.\n\n(2008-02-04, Casey Schaufler)"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"security/smack/smack_lsm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "4e49f997ef0c569e09b42aab6bd38c7c54ea095d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "dbece6c2f80b0470d8d99d7a016827dce99ed6e3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "7be4bd21c50afa83c93799b0f16cf5bfa493194e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "ec47f4177046dfaaf1cebb15f4d2e7b543475daf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "e35dc5a4ed6d1e536382d80c685187511ff248a1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "c2ab27c2e11591524b1378c24ad18882a425d1fa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "d02c55e3ea82e41ea2c2026e08201e5daa4d0cfe",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
|
|
"lessThan": "fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"security/smack/smack_lsm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.25",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.25",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.270",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.221",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.188",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.110",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.52",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.6",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.10.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.15.221"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.1.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.12.110"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.18.52"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.2.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4e49f997ef0c569e09b42aab6bd38c7c54ea095d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/dbece6c2f80b0470d8d99d7a016827dce99ed6e3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7be4bd21c50afa83c93799b0f16cf5bfa493194e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ec47f4177046dfaaf1cebb15f4d2e7b543475daf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e35dc5a4ed6d1e536382d80c685187511ff248a1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c2ab27c2e11591524b1378c24ad18882a425d1fa"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d02c55e3ea82e41ea2c2026e08201e5daa4d0cfe"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5"
|
|
}
|
|
],
|
|
"title": "smack: fix incorrect task context in smack_msg_queue_msgrcv",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |