oss-security - CVE request: kernel: open() call allows setgid bit when user is not in new file's group

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <48DA17E0.8050607@redhat.com>
Date: Wed, 24 Sep 2008 18:35:12 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
CC: coley@...re.org
Subject: CVE request: kernel: open() call allows setgid bit when user is not
 in new file's group

This was committed in upstream kernel; Reported by David Watson.

"When creating a file, open()/creat() allows the setgid bit to be set
via the mode argument even when, due to the bsdgroups mount option or
the file being created in a setgid directory, the new file's group is
one which the user is not a member of.  The user can then use
ftruncate() and memory-mapped I/O to turn the new file into an arbitrary
binary and thus gain the privileges of this group, since these
operations do not clear the setgid bit."

This bug could lead to a possible privileged information disclosure.

Upstream commit:
7b82dc0e64e93f430182f36b46b79fcee87d3532

References:
http://bugzilla.kernel.org/show_bug.cgi?id=8420
https://bugzilla.redhat.com/show_bug.cgi?id=463661

Thanks, Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.