oss-security - CVE request - kernel: xfs swapext ioctl issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 17 Jun 2010 18:42:03 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request - kernel: xfs swapext ioctl issue

User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by 
user "bar" into a file owned by "foo" and subsequently reading it. It 
does so by checking that the file descriptors passed to the ioctl are 
also opened for reading.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=605158
http://archives.free.net.ph/message/20100616.130710.301704aa.en.html
http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html

Thanks, Eugene
-- 
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.