Date: Wed, 13 Aug 2014 01:49:59 -0400 (EDT) From: cve-assign@...re.org To: kenton@...dstorm.io Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: ro bind mount bypass using user namespaces -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We are assigning two CVE IDs because the available information is that there were two discoverers. Even if the discoverer information is later clarified, there will still be these two CVE IDs. > https://git.kernel.org/cgit/linux/kernel/git/ebiederm/user-namespace.git/commit/?h=for-linus&id=db181ce011e3c033328608299cd6fac06ea50130 > > Kenton Varda <kenton@...dstorm.io> discovered that by remounting a > read-only bind mount read-only in a user namespace the > MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user > to the remount a read-only mount read-write. Use CVE-2014-5206. > https://git.kernel.org/cgit/linux/kernel/git/ebiederm/user-namespace.git/commit/?h=for-linus&id=9566d6742852c527bf5af38af5cbb878dad75705 > > While investigating the issue where in "mount --bind -oremount,ro ..." > would result in later "mount --bind -oremount,rw" succeeding even if > the mount started off locked I realized that there are several > additional mount flags that should be locked and are not. Use CVE-2014-5207. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJT6vjTAAoJEKllVAevmvmsEI4H+wWrFmadZJwDhgU8i5IfiVIl Oz/iPTeSCelGIH6BA5GAMbaEmMUf/ay0Jpa31y6MhOiw1KMsGGFvzGkLoy3Pb/T5 G682hBmQbZD1OnBdk3z2EnMd5i0/B3kzc1rXi4m9QJcmi216xnJnD0+lEVbRj5nf jruRJplaRiwYuXszZSWhAOBVMFb5MJ/4aNmUkKdpiywQjOWhykgjNNyxXby9Rxpo AkoLecJPn/IJ4mRmLTp3vo1x/GZUXmXFvKfsJdB5Ps+kOnX7ptMyap4GTjSvXcIc FSJ9Zfad0iAnflEQTAKEVHFu5vSzbUdWVC+qMapVjZXRnku8y3UzYJVEvqQDUTc= =Qzne -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ