| Summary: | CVE-2014-0181 kernel: net: insufficient permision checks of netlink messages | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Petr Matousek <pmatouse> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | agordeev, aquini, bhu, chazlett, davej, dhoward, edbrand, esammons, fhrbata, gansalmon, iboverma, itamar, jbenc, jforbes, jkacur, jkurik, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, moshiro, nobody, npajkovs, pholasek, plougher, rt-maint, rvrbovsk, security-response-team, williams, yoguma |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-12-04 17:37:49 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 1094266, 1094267, 1094268, 1094269, 1094270, 1094271, 1094272, 1097660, 1097661 | ||
| Bug Blocks: | 1094273 | ||
|
Description
Petr Matousek
2014-05-05 11:40:36 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1094270] Discussion about regression caused by the patch for CVE-2014-0181 -- http://www.spinics.net/lists/netdev/msg281707.html Upstream versions of the patches (Linus' tree) Patch 1: 5187cd055b6e81fc6526109456f8b20623148d5f Patch 2: a53b72c83a4216f2eb883ed45a0cbce014b8e62d Patch 3: a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b Patch 4: aa4cf9452f469f16cea8c96283b641b4576d4a7b Patch 5: 90f62cf30a78721641e08737bda787552428061e kernel-3.14.3-200.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. Are the RHEL-5/RHEL-6 kernels impacted by this issue? Statement: (none) kernel-3.14.4-100.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. The regression mentioned in comment 5 is still discussed upstream. There has been an RFC patch sent which seems to be in the right direction but still needs more work. (In reply to Jiri Benc from comment #14) > The regression mentioned in comment 5 is still discussed upstream. There has > been an RFC patch sent which seems to be in the right direction but still > needs more work. http://www.spinics.net/lists/netdev/msg284505.html Upstream commit 2d7a85f4b06e netlink: Only check file credentials for implicit destinations This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2014:0913 https://rhn.redhat.com/errata/RHSA-2014-0913.html IssueDescription: It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process. This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:1023 https://rhn.redhat.com/errata/RHSA-2014-1023.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2014:1392 https://rhn.redhat.com/errata/RHSA-2014-1392.html This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2014:1959 https://rhn.redhat.com/errata/RHSA-2014-1959.html |