Re: CVE-2008-2931 kernel: missing check before setting mount propagation

[Eugene Teo <eteo () redhat com>]

Eugene Teo wrote:
> The do_change_type routine in the Linux kernel has a missing check for
> capable(CAP_SYS_ADMIN). Even though the mount command restricts the
> changing of mountpoint type to only root users, it is possible for local
> unprivileged users to bypass and abuse this problem. More details can be
> found at: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2931
>
> This affects kernel versions from 2.6.15-rc1 up to 2.6.22-rc1. The

Correction: It should be up to 2.6.21.

Thanks,
Eugene
-- 
Eugene Teo / Red Hat Security Response Team