Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Apr 2009 18:06:16 -0400 (EDT)
From: "Steven M. Christey" <>
cc: "Steven M. Christey" <>
Subject: Re: CVE request: kernel: missing capabilities in

On Thu, 23 Apr 2009, Eugene Teo wrote:

> "When POSIX capabilities were introduced during the 2.1 Linux cycle, the
> fs mask, which represents the capabilities which having fsuid==0 is
> supposed to grant, did not include CAP_MKNOD and CAP_LINUX_IMMUTABLE.
> However, before capabilities the privilege to call these did in fact
> depend upon fsuid==0.

How is this different than CVE-2009-1072?  That CVE is based on the same
bug report by Igor Zhbanov, although the description doesn't mention

- Steve

Name: CVE-2009-1072
Status: Candidate
Reference: MLIST:[linux-kernel] 20090311 VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK?
Reference: URL:
Reference: MLIST:[oss-security] 20090323 CVE request: kernel: nfsd did not drop CAP_MKNOD for non-root
Reference: URL:
Reference: CONFIRM:;a=commitdiff;h=76a67ec6fb79ff3570dcb5342142c16098299911
Reference: CONFIRM:
Reference: SUSE:SUSE-SA:2009:021
Reference: URL:
Reference: BID:34205
Reference: URL:
Reference: SECUNIA:34422
Reference: URL:
Reference: SECUNIA:34432
Reference: URL:
Reference: SECUNIA:34786
Reference: URL:
Reference: VUPEN:ADV-2009-0802
Reference: URL:
Reference: XF:linux-kernel-capmknod-security-bypass(49356)
Reference: URL:

nfsd in the Linux kernel before does not drop the CAP_MKNOD
capability before handling a user request in a thread, which allows
local users to create device nodes, as demonstrated on a filesystem
that has been exported with the root_squash option.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.