Bug 500297 - (CVE-2009-1630) CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_perm...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
reported=20090512,public=20090509,imp...
: Security
Depends On: 500298 500299 500300 500301 500302
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-12 03:07 EDT by Eugene Teo (Security Response)
Modified: 2015-09-07 01:46 EDT (History)
18 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Upstream patch (1.31 KB, patch)
2009-05-20 00:08 EDT, Eugene Teo (Security Response)
no flags Details | Diff

  None (edit)
Description Eugene Teo (Security Response) 2009-05-12 03:07:07 EDT
Description of problem:
Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it O_READONLY which means EXEC permission will not be checked at that time.

This problem is observed by the following sequence (executed as root):

mount -t nfs4 server:/ /mnt4
echo "ls" >/mnt4/foo
chmod 744 /mnt4/foo
su guest -c "mnt4/foo"

Reference:
http://article.gmane.org/gmane.linux.nfs/26592
Comment 2 Eugene Teo (Security Response) 2009-05-12 03:17:14 EDT
This looks like the same problem that was reported in November 2006:
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
Comment 8 Eugene Teo (Security Response) 2009-05-13 22:54:43 EDT
http://marc.info/?l=oss-security&m=124220557025302&w=2
Comment 9 Jan Lieskovsky 2009-05-14 14:02:30 EDT
CVE-2009-1630:

The nfs_permission function in fs/nfs/dir.c in the NFS client
implementation in the Linux kernel 2.6.29.3 and earlier, when
atomic_open is available, does not check execute (aka EXEC or
MAY_EXEC) permission bits, which allows local users to bypass
permissions and execute files, as demonstrated by files on an NFSv4
fileserver. 

References:
http://article.gmane.org/gmane.linux.nfs/26592
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
http://www.securityfocus.com/bid/34934
Comment 10 Eugene Teo (Security Response) 2009-05-20 00:08:26 EDT
Created attachment 344739 [details]
Upstream patch

http://git.kernel.org/linus/7ee2cb7f32b299c2b06a31fde155457203e4b7dd
Comment 13 Lachlan McIlroy 2009-05-28 21:27:31 EDT
Add issue 296766.
Comment 14 errata-xmlrpc 2009-06-16 18:34:24 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1106 https://rhn.redhat.com/errata/RHSA-2009-1106.html
Comment 16 errata-xmlrpc 2009-06-30 04:06:12 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1132 https://rhn.redhat.com/errata/RHSA-2009-1132.html
Comment 17 errata-xmlrpc 2009-07-14 15:11:20 EDT
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1157 https://rhn.redhat.com/errata/RHSA-2009-1157.html

Note You need to log in before you can comment on or make changes to this bug.