oss-sec mailing list archives
Re: CVE-2014-4014: Linux kernel user namespace bug
From: Andy Lutomirski <luto () amacapital net>
Date: Tue, 17 Jun 2014 14:47:46 -0700
On Tue, Jun 10, 2014 at 2:49 PM, Andy Lutomirski <luto () amacapital net> wrote:
The internal function inode_capable was used inappropriately. Depending on configuration, this may be usable to escalate privileges. A cursory inspection of my Fedora box suggests that it is not vulnerable to the obvious way to exploit this bug. The fix should appear in Linus' -master shortly, and it's tagged for stable. In the mean time, I've attached it here.
The commit that fixes this is: 23adbe12ef7d3d4195e80800ab36b37bee28cd03 The bug is that, if you created a user namespace and retained capabilities in that namespace, then you could use chmod to set the setgid bit on any file you owned, including files with, say, group 0. The impact depends on what files are available that have gids that shouldn't be available to the users who own the file. For example, the existence of a uid != 0, gid == 0 file would allow that uid to escalate privileges to gid 0, which is likely good enough for full root. --Andy
Current thread:
- CVE-2014-4014: Linux kernel user namespace bug Andy Lutomirski (Jun 10)
- Re: CVE-2014-4014: Linux kernel user namespace bug Andy Lutomirski (Jun 17)
- Re: Re: CVE-2014-4014: Linux kernel user namespace bug Sven Kieske (Jun 18)
- Re: CVE-2014-4014: Linux kernel user namespace bug Andy Lutomirski (Jun 23)
- Re: Re: CVE-2014-4014: Linux kernel user namespace bug Sven Kieske (Jun 18)
- Re: CVE-2014-4014: Linux kernel user namespace bug Andy Lutomirski (Jun 17)