* [RHEL7.9 BZ1844300 CVE-2020-8694 v5 2/2] powercap: restrict energy meter to root access
[not found] <20201110204226.13389-1-dqiao@redhat.com>
@ 2020-11-10 20:42 ` Donghai Qiao
0 siblings, 0 replies; 2+ messages in thread
From: Donghai Qiao @ 2020-11-10 20:42 UTC (permalink / raw
To: dqiao; +Cc: Len Brown, stable
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1844300
Upstream status: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c496fa7c14991a23c03c62e44637e71
Build info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=32573686
CVE: CVE-2020-8694
author Len Brown <len.brown@intel.com> 2020-11-10 13:00:00 -0800
committer Len Brown <len.brown@intel.com> 2020-11-10 11:40:57 -0500
commit 949dd0104c496fa7c14991a23c03c62e44637e71 (patch)
tree a90cbfb8ceb195e7160105a272122f97bab99980
parent 3d7772ea5602b88c7c7f0a50d512171a2eed6659 (diff)
download linux-949dd0104c496fa7c14991a23c03c62e44637e71.tar.gz
powercap: restrict energy meter to root access
Remove non-privileged user access to power data contained in
/sys/class/powercap/intel-rapl*/*/energy_uj
Non-privileged users currently have read access to power data and can
use this data to form a security attack. Some privileged
drivers/applications need read access to this data, but don't expose it
to non-privileged users.
For example, thermald uses this data to ensure that power management
works correctly. Thus removing non-privileged access is preferred over
completely disabling this power reporting capability with
CONFIG_INTEL_RAPL=n.
Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter")
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Donghai Qiao <dqiao@redhat.com>
---
drivers/powercap/powercap_sys.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 05ddf8be64a..db69be2892a 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -379,9 +379,9 @@ static void create_power_zone_common_attributes(
&dev_attr_max_energy_range_uj.attr;
if (power_zone->ops->get_energy_uj) {
if (power_zone->ops->reset_energy_uj)
- dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+ dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR;
else
- dev_attr_energy_uj.attr.mode = S_IRUGO;
+ dev_attr_energy_uj.attr.mode = S_IRUSR;
power_zone->zone_dev_attrs[count++] =
&dev_attr_energy_uj.attr;
}
--
2.18.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [RHEL7.9 BZ1844300 CVE-2020-8694 v5 2/2] powercap: restrict energy meter to root access
[not found] <20201110210357.14388-1-dqiao@redhat.com>
@ 2020-11-10 21:03 ` Donghai Qiao
0 siblings, 0 replies; 2+ messages in thread
From: Donghai Qiao @ 2020-11-10 21:03 UTC (permalink / raw
To: rhkernel-list; +Cc: Donghai Qiao, Len Brown, stable
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1844300
Upstream status: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c496fa7c14991a23c03c62e44637e71
Build info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=32573686
CVE: CVE-2020-8694
author Len Brown <len.brown@intel.com> 2020-11-10 13:00:00 -0800
committer Len Brown <len.brown@intel.com> 2020-11-10 11:40:57 -0500
commit 949dd0104c496fa7c14991a23c03c62e44637e71 (patch)
tree a90cbfb8ceb195e7160105a272122f97bab99980
parent 3d7772ea5602b88c7c7f0a50d512171a2eed6659 (diff)
download linux-949dd0104c496fa7c14991a23c03c62e44637e71.tar.gz
powercap: restrict energy meter to root access
Remove non-privileged user access to power data contained in
/sys/class/powercap/intel-rapl*/*/energy_uj
Non-privileged users currently have read access to power data and can
use this data to form a security attack. Some privileged
drivers/applications need read access to this data, but don't expose it
to non-privileged users.
For example, thermald uses this data to ensure that power management
works correctly. Thus removing non-privileged access is preferred over
completely disabling this power reporting capability with
CONFIG_INTEL_RAPL=n.
Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter")
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Donghai Qiao <dqiao@redhat.com>
---
drivers/powercap/powercap_sys.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 05ddf8be64a..db69be2892a 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -379,9 +379,9 @@ static void create_power_zone_common_attributes(
&dev_attr_max_energy_range_uj.attr;
if (power_zone->ops->get_energy_uj) {
if (power_zone->ops->reset_energy_uj)
- dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+ dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR;
else
- dev_attr_energy_uj.attr.mode = S_IRUGO;
+ dev_attr_energy_uj.attr.mode = S_IRUSR;
power_zone->zone_dev_attrs[count++] =
&dev_attr_energy_uj.attr;
}
--
2.18.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-11-10 21:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20201110204226.13389-1-dqiao@redhat.com>
2020-11-10 20:42 ` [RHEL7.9 BZ1844300 CVE-2020-8694 v5 2/2] powercap: restrict energy meter to root access Donghai Qiao
[not found] <20201110210357.14388-1-dqiao@redhat.com>
2020-11-10 21:03 ` Donghai Qiao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.