oss-security - CVE Request: Linux kernel: privilege escalation in user namespaces

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <567339BE.3090404@canonical.com>
Date: Thu, 17 Dec 2015 14:39:58 -0800
From: John Johansen <john.johansen@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: Linux kernel: privilege escalation in user namespaces

Hi,

I haven't seen CVE request for this one yet so,

Jann Horn reported a privilege escalation in user namespaces to the
lkml mailing list

https://lkml.org/lkml/2015/12/12/259

if a root-owned process wants to enter a user
namespace for some reason without knowing who owns it and
therefore can't change to the namespace owner's uid and gid
before entering, as soon as it has entered the namespace,
the namespace owner can attach to it via ptrace and thereby
gain access to its uid and gid.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.