[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 Sep 2009 01:58:52 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: issue with O_EXCL creates
on NFSv4
On Mon, 21 Sep 2009, Eugene Teo wrote:
> Upstream commits:
> http://git.kernel.org/linus/af85852d (fixed in v2.6.19-rc6)
> http://git.kernel.org/linus/81ac95c5 (fixed in v2.6.19-rc6)
> http://git.kernel.org/linus/79fb54ab (fixed in v2.6.30-rc1)
I can't see any clear relationship between these commits and the Red Hat
bugzilla entry. The implication that there were two fixes, one in 2.6.19
and one in 2.6.30, is also confusing because if a fix in 2.6.19 didn't
work, we'd normally assign a new CVE for the fix in 2.6.30.
CVE-2009-3286 is below, anchored on what's said in Bugzilla 524520. Since
81ac95c also mentions do_open_permission, I used that as a reference.
This suggests the problem was fixed in 2006, but this issue doesn't have a
CVE identifier because security implications weren't spelled out until
Eugene's post (as far as I can tell.)
- Steve
======================================================
Name: CVE-2009-3286
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3286
Acknowledged: yes bug-report
Announced: 20090909
Flaw: other
Reference: MLIST:[oss-security] 20090921 CVE request: kernel: issue with O_EXCL creates on NFSv4
Reference: URL:http://www.openwall.com/lists/oss-security/2009/09/21/2
Reference: CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=81ac95c5
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=524520
NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does
not properly clean up an inode when an O_EXCL create fails, which
causes files to be created with insecure settings such as setuid bits,
and possibly allows local users to gain privileges, related to the
execution of the do_open_permission function even when a create fails.
That also explains why we don't see this problem with root...the
permission check is always passing there (provided we're not root
squashing).
Analysis:
ACCURACY/ACKNOWLEDGEMENT: bug 524520 says "What's happening here is
that the inital create is occurring, but then the permission check for
the open fails. This short-circuits the rest of the process, causes
the open to return an error and leaves the inode in this funky state."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
