[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53EB8E29.1070606@mittwald.de>
Date: Wed, 13 Aug 2014 16:08:04 +0000
From: Sven Kieske <S.Kieske@...twald.de>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE Request: ro bind mount bypass using user
namespaces
Am 12.08.2014 23:48, schrieb Kenton Varda:
> Due to a bug in the Linux kernel's implementation of remount, on systems
> with unprivileged user namespaces enabled, it is possible for an
> unprivileged user to gain write access to any visible read-only bind mount.
> It is also possible to bypass flags like nodev, nosuid, and noexec.
Hi,
does someone happen to know in which released kernel version this bug
got introduced?
Was it always there since remounting of bind mounts was possible?
according to debian this at least affects 2.6.32 kernels
in oldstable:
https://security-tracker.debian.org/tracker/CVE-2014-5206
https://security-tracker.debian.org/tracker/CVE-2014-5207
Sadly I can't find any other public available bugtracker
from redhat, gentoo etc. who track these.
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
