[SRU Bionic/Focal/Impish/OEM-5.14 0/1] CVE-2022-0492

[Thadeu Lima de Souza Cascardo]

[Impact]
A user in a privileged container may be able to execute commands outside
the container.

[Backport]
5.4 backport is a simple fixup, coming from upstream 5.4.y.
4.15 backport comes from upstream 4.15.y and is move involved because
mount/remount has been changed to the fsconfig framework.

[Test case]
sudo unshare -UrmC sh -c 'echo /bin/true > /sys/fs/cgroup/rdma/release_agent' ; cat /sys/fs/cgroup/rdma/release_agent

[Potential regression]
cgroup mounts may be denied or writing to release_agent may be denied,
leading to some cgroups not being cleaned up.

Eric W. Biederman (1):
  cgroup-v1: Require capabilities to set release_agent

 kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

-- 
2.32.0