APPLIED: [SRU Bionic/Focal/Impish] CVE-2022-0492

[Stefan Bader]

On 14.02.22 14:35, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> A user in a privileged container may be able to execute commands outside
> the container.
> 
> [Backport]
> 5.4 backport is a simple fixup, coming from upstream 5.4.y.
> 4.15 backport comes from upstream 4.15.y and is move involved because
> mount/remount has been changed to the fsconfig framework.
> 
> [Test case]
> sudo unshare -UrmC sh -c 'echo /bin/true > /sys/fs/cgroup/rdma/release_agent' ; cat /sys/fs/cgroup/rdma/release_agent
> 
> [Potential regression]
> cgroup mounts may be denied or writing to release_agent may be denied,
> leading to some cgroups not being cleaned up.
> 
> Eric W. Biederman (1):
>    cgroup-v1: Require capabilities to set release_agent
> 
>   kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 

Applied to bionic,focal,impish:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20220215/1a7eb3b0/attachment.sig>