)]}'
{
  "commit": "57ce5b0be1212d053cb2e50f4bd4f8d95286884d",
  "tree": "bad516c21c1489f6191f38dd64b0a9150011eef3",
  "parents": [
    "d3792f1ae42a38b726aa2a0ecd01cd8692cda8de"
  ],
  "author": {
    "name": "Laszlo Ersek",
    "email": "lersek@redhat.com",
    "time": "Mon Jul 31 18:42:37 2023 +0200"
  },
  "committer": {
    "name": "COS Cherry Picker",
    "email": "cloud-image-release@prod.google.com",
    "time": "Wed Aug 16 12:34:02 2023 -0700"
  },
  "message": "net: tap_open(): set sk_uid from current_fsuid()\n\ncommit 5c9241f3ceab3257abe2923a59950db0dc8bb737 upstream.\n\nCommit 66b2c338adce initializes the \"sk_uid\" field in the protocol socket\n(struct sock) from the \"/dev/tapX\" device node\u0027s owner UID. Per original\ncommit 86741ec25462 (\"net: core: Add a UID field to struct sock.\",\n2016-11-04), that\u0027s wrong: the idea is to cache the UID of the userspace\nprocess that creates the socket. Commit 86741ec25462 mentions socket() and\naccept(); with \"tap\", the action that creates the socket is\nopen(\"/dev/tapX\").\n\nTherefore the device node\u0027s owner UID is irrelevant. In most cases,\n\"/dev/tapX\" will be owned by root, so in practice, commit 66b2c338adce has\nno observable effect:\n\n- before, \"sk_uid\" would be zero, due to undefined behavior\n  (CVE-2023-1076),\n\n- after, \"sk_uid\" would be zero, due to \"/dev/tapX\" being owned by root.\n\nWhat matters is the (fs)UID of the process performing the open(), so cache\nthat in \"sk_uid\".\n\nBUG\u003db/296028775\nTEST\u003dpresubmit\nSOURCE\u003dUPSTREAM(5c9241f3ceab)\nRELEASE_NOTE\u003dFixed CVE-2023-4194 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 66b2c338adce (\"tap: tap_open(): correctly initialize socket uid\")\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d2173435\nChange-Id: Ib00b3f3a33be8a839e4157bd0c051f0007f93e35\nSigned-off-by: Laszlo Ersek \u003clersek@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/55116\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3c468ef8f245fca13d15a096a4acaffeb9806e84",
      "old_mode": 33188,
      "old_path": "drivers/net/tap.c",
      "new_id": "8c010857e6d7064a74468b051bb3b2818f4836d8",
      "new_mode": 33188,
      "new_path": "drivers/net/tap.c"
    }
  ]
}