Bug 1416126 (CVE-2017-5551)

Summary:	CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aquini, bhu, dhoward, dominik.mierzejewski, fhrbata, gansalmon, iboverma, ichavero, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mkern, nmurray, pholasek, plougher, rt-maint, rvrbovsk, slawomir, vdronov, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A vulnerability was found in the Linux kernel in 'tmpfs' file system. When file permissions are modified via 'chmod' and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via 'setxattr' sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in 'chmod'.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:06:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1371252, 1371253, 1371254, 1371255, 1416128, 1420840, 1420841, 1420847, 1420848, 1420849, 1420850
Bug Blocks:	1416132

Description Adam Mariš 2017-01-24 16:25:33 UTC

It was found that fix for CVE-2016-7097 was incomplete as it missed tmpfs.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31

CVE assignment:

http://seclists.org/oss-sec/2017/q1/161

Comment 1 Adam Mariš 2017-01-24 16:31:01 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1416128]

Comment 9 Vladis Dronov 2017-02-09 16:02:32 UTC

[disregard]

Comment 13 Vladis Dronov 2018-09-03 12:59:36 UTC

Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix.

Comment 14 Vladis Dronov 2018-09-03 13:00:21 UTC

Notes:

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix:

https://bugzilla.redhat.com/show_bug.cgi?id=1368938