[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <fa4662c4-ce58-48ec-85a4-b0272ca9931a@seltendoof.de>
Date: Tue, 7 Apr 2026 22:14:42 +0200
From: Christian Göttsche <cgoettsche@...tendoof.de>
To: oss-security@...ts.openwall.com
Subject: Re: libcap-2.77 (since libcap-2.04) has TOCTOU
privilege escalation issue
Apr 7, 2026 18:54:22 Andrew G. Morgan <morgan@...nel.org>:
> Hi,
>
> I've just released libcap-2.78 which includes a fix for a TOCTOU issue
> in libcap.
>
> The issue has been allocated the following code: CVE-2026-4878. It is
> the subject of this private bug:
> https://bugzilla.redhat.com/show_bug.cgi?id=2447554 and is also
> written up in a github.com advisory which I will publish on Wednesday
> (this week). The github advisory tool characterizes the issue as
> CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (Severity: Moderate 7 /
> 10).
>
> The fix for pretty much that whole range of libcap releases is this commit:
>
> https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596
Hi,
the new code suppports changing the file capabilities of all kinds of files (not just regular)(given that the caller has read permissions).
Is that intended?
Best regards,
Christian Göttsche
> As the code is publicly available, there is no embargo in place for
> releasing fixes.
>
> Cheers
>
> Andrew
>
> PS I tried a few times to post to the private openwall list about this
> issue 9 days ago, but my email bounced (likely because I couldn't
> effectively follow the mail formatting requirements). I might have
> realized that the emails were bounced if gmail hadn't silently placed
> the bounced replies in my SPAM folder. Sorry about that.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
