Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1214030 - (CVE-2015-3339) CVE-2015-3339 kernel: race condition between chown() and execve()
CVE-2015-3339 kernel: race condition between chown() and execve()
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20150420,repor...
: Security
Depends On: 1216267 1216268 1216269 1216270 1216307 1216308 1217698 1218641 1218643
Blocks: 1214031
  Show dependency tree / graph
 
Reported: 2015-04-21 15:10 EDT by Martin Prpič
Modified: 2017-08-10 01:52 EDT (History)
35 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A race condition flaw was found between the chown and execve system calls. When changing the owner of a setuid user binary to root, the race condition could momentarily make the binary setuid root. A local, unprivileged user could potentially use this flaw to escalate their privileges on the system.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-10 01:52:51 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1272 normal SHIPPED_LIVE Moderate: kernel security, bug fix, and enhancement update 2015-07-22 07:56:25 EDT
Red Hat Product Errata RHSA-2015:2152 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2015-11-19 19:56:02 EST
Red Hat Product Errata RHSA-2015:2411 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-11-19 06:24:06 EST

  None (edit)
Description Martin Prpič 2015-04-21 15:10:44 EDT 
A race condition flaw was found between the chown() and execve() system calls. When changing the owner of a setuid-user binary to root, the race condition could momentarily make the binary setuid root. When root chown()ed an attacker-owned setuid file to root, the file briefly was setuid root (and executable as such).

An attacker could take advantage of this small window and execute a setuid binary with elevated privileges.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543

Additional details:

http://seclists.org/oss-sec/2015/q2/216
Comment 1 Josh Boyer 2015-04-24 12:50:36 EDT 
I went ahead and backported this to Fedora.  All branches are fixed in git.
Comment 2 Wade Mealing 2015-04-26 20:53:41 EDT 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 7 and MRG-2. This issue is not currently planned to be addressed in future Red Hat Enterprise Linux 5 kernel updates.  Future Linux kernel updates for other releases may address this issue.

For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Comment 11 Fedora Update System 2015-05-03 13:22:37 EDT 
kernel-4.0.1-300.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2015-05-12 16:41:00 EDT 
kernel-3.19.7-200.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2015-05-25 23:56:05 EDT 
kernel-3.19.8-100.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 errata-xmlrpc 2015-07-22 04:48:47 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1272 https://rhn.redhat.com/errata/RHSA-2015-1272.html
Comment 16 errata-xmlrpc 2015-11-19 08:18:31 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2411 https://rhn.redhat.com/errata/RHSA-2015-2411.html
Comment 17 errata-xmlrpc 2015-11-19 17:09:08 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html
Comment 18 errata-xmlrpc 2015-11-19 18:25:32 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.