Bug 500297 (CVE-2009-1630)

Summary: CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
Product: [Other] Security Response Reporter: Eugene Teo (Security Response) <eteo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: atangrin, bhu, dhoward, dpal, ejratl, jjarvis, jlieskov, lgoncalv, nmurray, rkhan, sgrubb, steved, tao, vgaikwad, vgoyal, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-19 09:06:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 500298, 500299, 500300, 500301, 500302    
Bug Blocks:    
Attachments:
Description Flags
Upstream patch none

Description Eugene Teo (Security Response) 2009-05-12 07:07:07 UTC 
Description of problem:
Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it O_READONLY which means EXEC permission will not be checked at that time.

This problem is observed by the following sequence (executed as root):

mount -t nfs4 server:/ /mnt4
echo "ls" >/mnt4/foo
chmod 744 /mnt4/foo
su guest -c "mnt4/foo"

Reference:
http://article.gmane.org/gmane.linux.nfs/26592
Comment 2 Eugene Teo (Security Response) 2009-05-12 07:17:14 UTC 
This looks like the same problem that was reported in November 2006:
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
Comment 8 Eugene Teo (Security Response) 2009-05-14 02:54:43 UTC 
http://marc.info/?l=oss-security&m=124220557025302&w=2
Comment 9 Jan Lieskovsky 2009-05-14 18:02:30 UTC 
CVE-2009-1630:

The nfs_permission function in fs/nfs/dir.c in the NFS client
implementation in the Linux kernel 2.6.29.3 and earlier, when
atomic_open is available, does not check execute (aka EXEC or
MAY_EXEC) permission bits, which allows local users to bypass
permissions and execute files, as demonstrated by files on an NFSv4
fileserver. 

References:
http://article.gmane.org/gmane.linux.nfs/26592
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
http://www.securityfocus.com/bid/34934
Comment 10 Eugene Teo (Security Response) 2009-05-20 04:08:26 UTC 
Created attachment 344739 [details]
Upstream patch

http://git.kernel.org/linus/7ee2cb7f32b299c2b06a31fde155457203e4b7dd
Comment 13 Lachlan McIlroy 2009-05-29 01:27:31 UTC 
Add issue 296766.
Comment 14 errata-xmlrpc 2009-06-16 22:34:24 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1106 https://rhn.redhat.com/errata/RHSA-2009-1106.html
Comment 16 errata-xmlrpc 2009-06-30 08:06:12 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1132 https://rhn.redhat.com/errata/RHSA-2009-1132.html
Comment 17 errata-xmlrpc 2009-07-14 19:11:20 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1157 https://rhn.redhat.com/errata/RHSA-2009-1157.html