Bug 2275616 (CVE-2024-26821)

Summary:	CVE-2024-26821 kernel: fs: relax mount_setattr() permission checks
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sidakwo, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.1.79, kernel 6.6.18, kernel 6.7.6, kernel 6.8	Doc Type:	If docs needed, set a value
Doc Text:	[REJECTED CVE] CVE-2024-26821 was initially identified as a vulnerability related to the mount_setattr() function in the Linux kernel, which dealt with permission checks for mounting file systems. The issue was addressed by relaxing certain permission checks to align with legacy behavior. However, this CVE has been rejected and is no longer considered a valid security vulnerability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2275617
Bug Blocks:	2275560

Description Robb Gatica 2024-04-17 16:39:26 UTC

In the Linux kernel, the following vulnerability has been resolved:

fs: relax mount_setattr() permission checks

The Linux kernel CVE team has assigned CVE-2024-26821 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024041702-CVE-2024-26821-de6b@gregkh/T

Comment 1 Robb Gatica 2024-04-17 16:40:03 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2275617]

Comment 6 Alex 2024-06-09 15:26:49 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-26821 is: CHECK	Maybe valid. Check manually. with impact MODERATE (that is approximation based on flags DISK IMPROVEONLY  ; these flags parsed automatically based on patche data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing CVE). Highs always checked manually (I check it myself and then we check it again in Remediation team). In rare cases some of the Moderates could be increased to High later.

Comment 7 Eric Sandeen 2024-06-12 04:05:05 UTC

Note, his has been rejected upstream:

"The Linux kernel CVE team has assigned CVE-2024-26821 to this issue.
This one probably needs to be disputed as it isn't an actual
vulnerability, but rather a fix for the mount_setattr which previously
didn't allow reconfiguring the real rootfs similar to what the mount
syscall always allowed to do.

So it merely brings mount_attr up to par with mount in terms of allowing
the real rootfs to be reconfigured.

Christian, what do you think ?
Yeah, it's not security related at all. It just allows _additional_
functionality. Not sure how that ended up on the CVE list. Thanks for
pinging about this!
Now rejected, thanks all for reviewing this and letting us know.

greg k-h"

Comment 8 TEJ RATHI 2025-05-15 10:58:11 UTC

This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2024051643-REJECTED-4a96@gregkh/