Linux Kernel Anonymous Inode Security Context Vulnerability in Secretmem

A vulnerability in the Linux kernel's handling of anonymous inodes has been addressed. The issue arose in the secret memory (secretmem) feature, where the S_PRIVATE flag was not properly cleared, allowing Linux Security Module (LSM) and SELinux checks to be bypassed for secretmem file descriptors. This vulnerability has been resolved by exporting the anon_inode_make_secure_inode() function to enable KVM guest memory file descriptors to create anonymous inodes with the correct security context. The change replaces the previous method of manually setting the security context, thereby restoring proper LSM/SELinux enforcement for secretmem file descriptors.

Impact

The vulnerability could lead to a bypass of LSM/SELinux checks, allowing unauthorized access or manipulation of secretmem file descriptors.