[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 21 Sep 2009 13:45:31 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: issue with O_EXCL creates on NFSv4
There is an issue with O_EXCL creates on NFSv4 that with enough
attempts, it is possible for a lingering file from a failed create that
is world-writable but only setuid execute as the user who is attempting
these creates. Fortunately, root is not susceptible to this bug, so a
setuid root file should not be possible. It might be possible to exploit
this to gain access as another user though.
In-depth description/reproducer:
https://bugzilla.redhat.com/show_bug.cgi?id=524520#c0
Upstream commits:
http://git.kernel.org/linus/af85852d (fixed in v2.6.19-rc6)
http://git.kernel.org/linus/81ac95c5 (fixed in v2.6.19-rc6)
http://git.kernel.org/linus/79fb54ab (fixed in v2.6.30-rc1)
Thanks, Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
