[<prev] [next>] [day] [month] [year] [list]
Message-ID: <217636066.6300862.1472459619099.JavaMail.zimbra@redhat.com>
Date: Mon, 29 Aug 2016 04:33:39 -0400 (EDT)
From: Vladis Dronov <vdronov@...hat.com>
To: me@...fdog.net
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request -- linux kernel: Setting a POSIX ACL
via setxattr doesn't clear the setgid bit
Hello,
Honestly, I do not see a relation between this patch and overlays. The patch
touches the code of underlying filesystems. So, most probably, upperdir ACL
issue is not fixed by this suggested patch.
Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer
----- Original Message -----
From: me@...fdog.net
To: oss-security@...ts.openwall.com, "Vladis Dronov" <vdronov@...hat.com>
Sent: Saturday, August 27, 2016 1:24:47 PM
Subject: Re: [oss-security] CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit
Vladis Dronov writes:
> Hello,
>
> We would like to ask for a CVE-ID for the following securuty flaw.
>
> When file permissions are modified via chmod(2) and the user is not in
> the owning group or capable of CAP_FSETID, the setgid bit is cleared in
> inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file
> permissions as well as the new ACL, but doesn't clear the setgid bit in
> a similar way; this allows to bypass the check in chmod(2).
> ...
Does this also fix the upperdir ACL access gain from
http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
?
The overlayfs upperdir part is already fixed, so the one would
have to execute replacement commands for the steps already prohibited
by the userns/overlayfs fixes.
hd
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
