oss-sec mailing list archives
Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit
From: Vladis Dronov <vdronov () redhat com>
Date: Mon, 29 Aug 2016 04:33:39 -0400 (EDT)
Hello, Honestly, I do not see a relation between this patch and overlays. The patch touches the code of underlying filesystems. So, most probably, upperdir ACL issue is not fixed by this suggested patch. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer ----- Original Message ----- From: me () halfdog net To: oss-security () lists openwall com, "Vladis Dronov" <vdronov () redhat com> Sent: Saturday, August 27, 2016 1:24:47 PM Subject: Re: [oss-security] CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit Vladis Dronov writes:
Hello, We would like to ask for a CVE-ID for the following securuty flaw. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). ...
Does this also fix the upperdir ACL access gain from http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/ ? The overlayfs upperdir part is already fixed, so the one would have to execute replacement commands for the steps already prohibited by the userns/overlayfs fixes. hd
Current thread:
- CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit Vladis Dronov (Aug 26)
- Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit cve-assign (Aug 26)
- Message not available
- Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit Vladis Dronov (Aug 29)