Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 Jun 2014 14:47:46 -0700
From: Andy Lutomirski <>
Subject: Re: CVE-2014-4014: Linux kernel user namespace bug

On Tue, Jun 10, 2014 at 2:49 PM, Andy Lutomirski <> wrote:
> The internal function inode_capable was used inappropriately.
> Depending on configuration, this may be usable to escalate privileges.
> A cursory inspection of my Fedora box suggests that it is not
> vulnerable to the obvious way to exploit this bug.
> The fix should appear in Linus' -master shortly, and it's tagged for
> stable.  In the mean time, I've attached it here.

The commit that fixes this is:


The bug is that, if you created a user namespace and retained
capabilities in that namespace, then you could use chmod to set the
setgid bit on any file you owned, including files with, say, group 0.

The impact depends on what files are available that have gids that
shouldn't be available to the users who own the file.  For example,
the existence of a uid != 0, gid == 0 file would allow that uid to
escalate privileges to gid 0, which is likely good enough for full


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.