Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 09 Oct 2014 08:56:20 -0700
From: Andy Lutomirski <>
Subject: Re: CVE-2014-7975: 0-day umount denial of service

On 10/09/2014 04:06 AM, wrote:
>>>>>> "Andy" == Andy Lutomirski <> writes:
>     Andy> I just screwed up and typoed my git send-email command, so
>     Andy> there's now a publicly available exploit for a new umount bug.
>     Andy> Fortunately this one isn't terribly serious, but it might be
>     Andy> usable for more than just DoS if some daemon reacts poorly to
>     Andy> being unable to write to the filesystem.
>     Andy>
> Hmm, what damage is this supposed to do? I get (3.12.29):
> ql-front-t:/dev/pts# /root/remount-exploit /dev
> remount_ro, a DoS by Andy Lutomirski
> remount-exploit: umount: Device or resource busy
> Maybe you should specify what versions are supposed to be vulnerable

The PoC does pretty much the same thing as

# mount -o remount,ro TARGET

but it doesn't require privilege to run.

Due to the way that Linux handles filesystem business, it is unlikely to
work on filesystems that have anything open for writing.  (It works on
my Fedora system targetting /dev.)  The upshot is that it may be
difficult to exploit in any meaningful way on some systems.

It may also work more reliably against network filesystems.  I'm not
really sure.

That output means that you're vulnerable.  You would have gotten
something like "Permission denied" if you weren't vulnerable.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.