oss-sec mailing list archives
Re: CVE Request: ro bind mount bypass using user namespaces
From: Sven Kieske <S.Kieske () mittwald de>
Date: Wed, 13 Aug 2014 16:08:04 +0000
Am 12.08.2014 23:48, schrieb Kenton Varda:
Due to a bug in the Linux kernel's implementation of remount, on systems with unprivileged user namespaces enabled, it is possible for an unprivileged user to gain write access to any visible read-only bind mount. It is also possible to bypass flags like nodev, nosuid, and noexec.
Hi, does someone happen to know in which released kernel version this bug got introduced? Was it always there since remounting of bind mounts was possible? according to debian this at least affects 2.6.32 kernels in oldstable: https://security-tracker.debian.org/tracker/CVE-2014-5206 https://security-tracker.debian.org/tracker/CVE-2014-5207 Sadly I can't find any other public available bugtracker from redhat, gentoo etc. who track these. -- Mit freundlichen Grüßen / Regards Sven Kieske Systemadministrator Mittwald CM Service GmbH & Co. KG Königsberger Straße 6 32339 Espelkamp T: +49-5772-293-100 F: +49-5772-293-333 https://www.mittwald.de Geschäftsführer: Robert Meyer St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
Current thread:
- CVE Request: ro bind mount bypass using user namespaces Kenton Varda (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 13)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces cve-assign (Aug 12)
- Re: CVE Request: ro bind mount bypass using user namespaces Kenton Varda (Aug 13)
- Re: CVE Request: ro bind mount bypass using user namespaces Yves-Alexis Perez (Aug 13)
- Re: CVE Request: ro bind mount bypass using user namespaces Sven Kieske (Aug 13)
- <Possible follow-ups>
- Re: CVE Request: ro bind mount bypass using user namespaces Vitaly Nikolenko (Aug 14)
- Re: CVE Request: ro bind mount bypass using user namespaces Andy Lutomirski (Aug 12)