oss-security - Re: CVE-2008-2931 kernel: missing check before setting mount propagation

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 08 Jul 2008 19:30:02 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2008-2931 kernel: missing check before setting
 mount propagation

Eugene Teo wrote:
> The do_change_type routine in the Linux kernel has a missing check for
> capable(CAP_SYS_ADMIN). Even though the mount command restricts the
> changing of mountpoint type to only root users, it is possible for local
> unprivileged users to bypass and abuse this problem. More details can be
> found at: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2931
> 
> This affects kernel versions from 2.6.15-rc1 up to 2.6.22-rc1. The

Correction: It should be up to 2.6.21.

Thanks,
Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.