oss-security - Re: CVE request: kernel: missing capabilities in fs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49F2D667.7050005@redhat.com>
Date: Sat, 25 Apr 2009 17:22:47 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: missing capabilities in fs_mask

Hi Steve,

Steven M. Christey wrote:
> On Thu, 23 Apr 2009, Eugene Teo wrote:
> 
>> "When POSIX capabilities were introduced during the 2.1 Linux cycle, the
>> fs mask, which represents the capabilities which having fsuid==0 is
>> supposed to grant, did not include CAP_MKNOD and CAP_LINUX_IMMUTABLE.
>> However, before capabilities the privilege to call these did in fact
>> depend upon fsuid==0.
> 
> How is this different than CVE-2009-1072?  That CVE is based on the same
> bug report by Igor Zhbanov, although the description doesn't mention
> CAP_LINUX_IMMUTABLE.

Hmm. CVE-2009-1072 refers to the missing CAP_MKNOD capability in
CAP_NFSD_MASK, and this bug refers to the missing CAP_MKNOD and
CAP_LINUX_IMMUTABLE capabilities in CAP_FS_MASK. Come to think about it,
both are similar, and probably makes sense to have it part of
CVE-2009-1072 too?

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.