Date: Mon, 21 Sep 2009 13:45:31 +0800 From: Eugene Teo <eugeneteo@...nel.sg> To: oss-security@...ts.openwall.com CC: "Steven M. Christey" <coley@...us.mitre.org> Subject: CVE request: kernel: issue with O_EXCL creates on NFSv4 There is an issue with O_EXCL creates on NFSv4 that with enough attempts, it is possible for a lingering file from a failed create that is world-writable but only setuid execute as the user who is attempting these creates. Fortunately, root is not susceptible to this bug, so a setuid root file should not be possible. It might be possible to exploit this to gain access as another user though. In-depth description/reproducer: https://bugzilla.redhat.com/show_bug.cgi?id=524520#c0 Upstream commits: http://git.kernel.org/linus/af85852d (fixed in v2.6.19-rc6) http://git.kernel.org/linus/81ac95c5 (fixed in v2.6.19-rc6) http://git.kernel.org/linus/79fb54ab (fixed in v2.6.30-rc1) Thanks, Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.