Bug 491254 (CVE-2009-0787)
Summary: | CVE-2009-0787 kernel: ecryptfs file header infoleak | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | [Other] Security Response | Reporter: | Eugene Teo (Security Response) <eteo> | ||||||
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
Status: | CLOSED ERRATA | QA Contact: | |||||||
Severity: | medium | Docs Contact: | |||||||
Priority: | medium | ||||||||
Version: | unspecified | CC: | anton, atangrin, dhoward, esandeen, jpirko, lwang, mhlavink, security-response-team | ||||||
Target Milestone: | --- | Keywords: | Security | ||||||
Target Release: | --- | ||||||||
Hardware: | All | ||||||||
OS: | Linux | ||||||||
Whiteboard: | |||||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||||
Doc Text: | Story Points: | --- | |||||||
Clone Of: | Environment: | ||||||||
Last Closed: | 2013-04-08 17:31:37 UTC | Type: | --- | ||||||
Regression: | --- | Mount Type: | --- | ||||||
Documentation: | --- | CRM: | |||||||
Verified Versions: | Category: | --- | |||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||
Embargoed: | |||||||||
Bug Depends On: | 491255, 491256 | ||||||||
Bug Blocks: | |||||||||
Attachments: |
|
Comment 4
Eugene Teo (Security Response)
2009-03-20 04:29:46 UTC
eCryptfs is a Technology Preview feature in Red Hat Enterprise Linux 5.3, and it is not a default configuration - http://markmail.org/message/n2acz2wv7b5xkb2o. Created attachment 335965 [details]
Proposed upstream patch
It's public now: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8faece5f906725c10e7a1f6caf84452abadbdc7b Created attachment 336239 [details]
Upstream patch
Encrypted files that were created on systems running vulnerable version of the ecryptfs may contain leaked data in the ecryptfs file headers. ecryptfs-utils upstream developers created a script that can be used to re-encrypt files inside of ecryptfs mount by making a temporary copy of the file and replacing original with the copy, causing the file to be re-created / re-encrypted on the lower ecryptfs filesystem too. Script is available in the ecryptfs-utils source code repository: http://bazaar.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils/annotate/head:/src/utils/ecryptfs-rewrite-file http://bazaar.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils/annotate/head:/doc/manpage/ecryptfs-rewrite-file.1 Further information about its use is in the upstream bug report: https://bugs.launchpad.net/ecryptfs/+bug/345544/comments/5 This approach, however, has limitations, as ecryptfs files and mounts are under the control of the individual users. Script is meant to be used on files inside of an ecryptfs mount. Therefore, it can not be used to fully "resolve" the consequences this leak under all circumstance, as non-privileged users can not use it to remove "their" data leaked into other users' ecryptfs files, and system administrators can only use it on ecryptfs mounts that are mounted or have pass phrases known to them. This script may appear in the future updates of the ecryptfs-utils packages. More info: http://kbase.redhat.com/faq/docs/DOC-16748 This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:0473 https://rhn.redhat.com/errata/RHSA-2009-0473.html |