Bug 742907 (CVE-2011-3585)

Summary:	CVE-2011-3585 Samba mtab lock file race condition
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	asn, gdeschner, jlayton, prc, rcvalle, sbose, ssorce
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-10-17 15:48:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	742932

Description Jan Lieskovsky 2011-10-03 11:04:34 UTC

A race condition was found in the way 'mount.cifs' and 'umount.cifs' utilities performed mount / umount of a particular CIFS share to / from specified mount point (/etc/mtab~ lockfile was created before updating the /etc/mtab file and deleted once the operation completed), when these utilies were setuid root enabled. A local attacker could use this flaw to conduct denial of service attacks (failure of subsequent CIFS share umount / mount requests) by sending termination signal to 'mount.cifs' / 'umount.cifs' processes in the moment of existence of a stale (/etc/mtab~) lockfile.

References:
[1] https://bugzilla.samba.org/show_bug.cgi?id=7179
    (upstream bug report)
[2] http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200
    (upstream patch)
[3] http://www.openwall.com/lists/oss-security/2011/09/27/1
    (CVE request)
[4] http://www.openwall.com/lists/oss-security/2011/09/30/5
    (CVE assignment)

Note: This flaw to be exploitable as described above requires the 'mount.cifs'
      / 'umount.cifs' utilities to be setuid root enabled. These utilities
      are not setuid root enabled on Red Hat Enterprise Linux and Fedora
      distributions, and thus these distributions as such are not vulnerable
      to this flaw.

Comment 6 Ramon de C Valle 2011-10-17 15:48:10 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2011:1219 https://rhn.redhat.com/errata/RHSA-2011-1219.html

Comment 7 Ramon de C Valle 2011-10-20 15:42:45 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1221 https://rhn.redhat.com/errata/RHSA-2011-1221.html