Linux 2.6.22.4

Linux 2.6.22.4

[Greg Kroah-Hartman]

We (the -stable team) are announcing the release of the 2.6.22.4 kernel.
It contains one security fix and all users of the 2.6.22 series are
encouraged to upgrade to it.

I'll also be replying to this message with a copy of the patch between
2.6.22.3 and 2.6.22.4

The updated 2.6.22.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.22.y.git;a=summary

thanks,

greg k-h

--------

 Makefile  |    2 +-
 fs/exec.c |   13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

Summary of changes from v2.6.22.3 to v2.6.22.4
==============================================

Greg Kroah-Hartman (1):
      Linux 2.6.22.4

Marcel Holtmann (1):
      Reset current->pdeath_signal on SUID binary execution (CVE-2007-3848)

Re: Linux 2.6.22.4

[Greg Kroah-Hartman]

diff --git a/Makefile b/Makefile
index bc2d377..f2a62ee 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 22
-EXTRAVERSION = .3
+EXTRAVERSION = .4
 NAME = Holy Dancing Manatees, Batman!
 
 # *DOCUMENTATION*
diff --git a/fs/exec.c b/fs/exec.c
index f20561f..9a93770 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -890,9 +890,12 @@ int flush_old_exec(struct linux_binprm * bprm)
 	 */
 	current->mm->task_size = TASK_SIZE;
 
-	if (bprm->e_uid != current->euid || bprm->e_gid != current->egid || 
-	    file_permission(bprm->file, MAY_READ) ||
-	    (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
+	if (bprm->e_uid != current->euid || bprm->e_gid != current->egid) {
+		suid_keys(current);
+		current->mm->dumpable = suid_dumpable;
+		current->pdeath_signal = 0;
+	} else if (file_permission(bprm->file, MAY_READ) ||
+			(bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
 		suid_keys(current);
 		current->mm->dumpable = suid_dumpable;
 	}
@@ -983,8 +986,10 @@ void compute_creds(struct linux_binprm *bprm)
 {
 	int unsafe;
 
-	if (bprm->e_uid != current->uid)
+	if (bprm->e_uid != current->uid) {
 		suid_keys(current);
+		current->pdeath_signal = 0;
+	}
 	exec_keys(current);
 
 	task_lock(current);