svn commit: r359139 - in releng: 11.3/sys/dev/oce 12.1/sys/dev/oce

[Gordon Tetlow]

Author: gordon
Date: Thu Mar 19 16:48:29 2020
New Revision: 359139
URL: https://svnweb.freebsd.org/changeset/base/359139

Log:
  Fix insufficient oce(4) ioctl(2) privilege checking.
  
  Approved by:	so
  Security:	FreeBSD-SA-20:05.if_oce_ioctl
  Security:	CVE-2019-15876

Modified:
  releng/11.3/sys/dev/oce/oce_if.c
  releng/11.3/sys/dev/oce/oce_if.h
  releng/12.1/sys/dev/oce/oce_if.c
  releng/12.1/sys/dev/oce/oce_if.h

Modified: releng/11.3/sys/dev/oce/oce_if.c
==============================================================================
--- releng/11.3/sys/dev/oce/oce_if.c	Thu Mar 19 16:46:01 2020	(r359138)
+++ releng/11.3/sys/dev/oce/oce_if.c	Thu Mar 19 16:48:29 2020	(r359139)
@@ -616,6 +616,9 @@ oce_ioctl(struct ifnet *ifp, u_long command, caddr_t d
 		break;
 
 	case SIOCGPRIVATE_0:
+		rc = priv_check(curthread, PRIV_DRIVER);
+		if (rc != 0)
+			break;
 		rc = oce_handle_passthrough(ifp, data);
 		break;
 	default:

Modified: releng/11.3/sys/dev/oce/oce_if.h
==============================================================================
--- releng/11.3/sys/dev/oce/oce_if.h	Thu Mar 19 16:46:01 2020	(r359138)
+++ releng/11.3/sys/dev/oce/oce_if.h	Thu Mar 19 16:48:29 2020	(r359139)
@@ -46,6 +46,7 @@
 #include <sys/kernel.h>
 #include <sys/bus.h>
 #include <sys/mbuf.h>
+#include <sys/priv.h>
 #include <sys/rman.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>

Modified: releng/12.1/sys/dev/oce/oce_if.c
==============================================================================
--- releng/12.1/sys/dev/oce/oce_if.c	Thu Mar 19 16:46:01 2020	(r359138)
+++ releng/12.1/sys/dev/oce/oce_if.c	Thu Mar 19 16:48:29 2020	(r359139)
@@ -621,6 +621,9 @@ oce_ioctl(struct ifnet *ifp, u_long command, caddr_t d
 		break;
 
 	case SIOCGPRIVATE_0:
+		rc = priv_check(curthread, PRIV_DRIVER);
+		if (rc != 0)
+			break;
 		rc = oce_handle_passthrough(ifp, data);
 		break;
 	default:

Modified: releng/12.1/sys/dev/oce/oce_if.h
==============================================================================
--- releng/12.1/sys/dev/oce/oce_if.h	Thu Mar 19 16:46:01 2020	(r359138)
+++ releng/12.1/sys/dev/oce/oce_if.h	Thu Mar 19 16:48:29 2020	(r359139)
@@ -48,6 +48,7 @@
 #include <sys/kernel.h>
 #include <sys/bus.h>
 #include <sys/mbuf.h>
+#include <sys/priv.h>
 #include <sys/rman.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>