Bug 603593 (CVE-2010-2071)

Summary: CVE-2010-2071 kernel: btrfs: prevent users from setting ACLs on files they do not own
Product: [Other] Security Response Reporter: Eugene Teo (Security Response) <eteo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: high    
Version: unspecifiedCC: arozansk, davej, dfeng, kmcmartin, lwang, pmatouse, tcallawa
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-28 08:51:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 603594    
Bug Blocks:    

Description Eugene Teo (Security Response) 2010-06-14 02:08:58 UTC 
Description of problem:
http://lkml.org/lkml/2010/5/17/544

On btrfs, do the following
------------------
# su user1
# cd btrfs-part/
# touch aaa
# getfacl aaa
  # file: aaa
  # owner: user1
  # group: user1
  user::rw-
  group::rw-
  other::r--
# su user2
# cd btrfs-part/
# setfacl -m u::rwx aaa
# getfacl aaa
  # file: aaa
  # owner: user1
  # group: user1
  user::rwx           <- successed to setfacl
  group::rw-
  other::r--
------------------
but we should prohibit it that user2 changing user1's acl.
In fact, on ext3 and other fs, a message occurs:
  setfacl: aaa: Operation not permitted

Upstream commit:
http://git.kernel.org/linus/2f26afba
Comment 1 Eugene Teo (Security Response) 2010-06-14 02:09:28 UTC 
Meanwhile, we should also include http://git.kernel.org/linus/731e3d1b.
Comment 3 Eugene Teo (Security Response) 2010-06-14 02:11:28 UTC 
Statement:

Not vulnerable. This issue did not affect the versions of Linux kernel as
shipped with Red Hat Enterprise Linux 3, 4, 5 and Red Hat Enterprise MRG as
they did not include support for Btrfs, a new copy on write filesystem.
Comment 4 Fedora Update System 2010-07-08 18:22:57 UTC 
kernel-2.6.33.6-147.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2010-07-13 07:48:39 UTC 
kernel-2.6.32.16-141.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.