oss-security - CVE request: kernel: issue with O

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AB712FB.6080804@kernel.sg>
Date: Mon, 21 Sep 2009 13:45:31 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: issue with O_EXCL creates on NFSv4

There is an issue with O_EXCL creates on NFSv4 that with enough 
attempts, it is possible for a lingering file from a failed create that 
is world-writable but only setuid execute as the user who is attempting 
these creates. Fortunately, root is not susceptible to this bug, so a 
setuid root file should not be possible. It might be possible to exploit 
this to gain access as another user though.

In-depth description/reproducer:
https://bugzilla.redhat.com/show_bug.cgi?id=524520#c0

Upstream commits:
http://git.kernel.org/linus/af85852d (fixed in v2.6.19-rc6)
http://git.kernel.org/linus/81ac95c5 (fixed in v2.6.19-rc6)
http://git.kernel.org/linus/79fb54ab (fixed in v2.6.30-rc1)

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.