Bug 500297 (CVE-2009-1630) - CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
Summary: CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_perm...
Keywords:
Status: NEW
Alias: CVE-2009-1630
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 500298 500299 500300 500301 500302
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-05-12 07:07 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:30 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)
Upstream patch (1.31 KB, patch)
2009-05-20 04:08 UTC, Eugene Teo (Security Response)
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1106 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-06-16 22:34:13 UTC
Red Hat Product Errata RHSA-2009:1132 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-06-30 08:06:02 UTC
Red Hat Product Errata RHSA-2009:1157 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2009-07-14 19:11:05 UTC

Description Eugene Teo (Security Response) 2009-05-12 07:07:07 UTC
Description of problem:
Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it O_READONLY which means EXEC permission will not be checked at that time.

This problem is observed by the following sequence (executed as root):

mount -t nfs4 server:/ /mnt4
echo "ls" >/mnt4/foo
chmod 744 /mnt4/foo
su guest -c "mnt4/foo"

Reference:
http://article.gmane.org/gmane.linux.nfs/26592

Comment 2 Eugene Teo (Security Response) 2009-05-12 07:17:14 UTC
This looks like the same problem that was reported in November 2006:
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131

Comment 8 Eugene Teo (Security Response) 2009-05-14 02:54:43 UTC
http://marc.info/?l=oss-security&m=124220557025302&w=2

Comment 9 Jan Lieskovsky 2009-05-14 18:02:30 UTC
CVE-2009-1630:

The nfs_permission function in fs/nfs/dir.c in the NFS client
implementation in the Linux kernel 2.6.29.3 and earlier, when
atomic_open is available, does not check execute (aka EXEC or
MAY_EXEC) permission bits, which allows local users to bypass
permissions and execute files, as demonstrated by files on an NFSv4
fileserver. 

References:
http://article.gmane.org/gmane.linux.nfs/26592
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
http://www.securityfocus.com/bid/34934

Comment 10 Eugene Teo (Security Response) 2009-05-20 04:08:26 UTC
Created attachment 344739 [details]
Upstream patch

http://git.kernel.org/linus/7ee2cb7f32b299c2b06a31fde155457203e4b7dd

Comment 13 Lachlan McIlroy 2009-05-29 01:27:31 UTC
Add issue 296766.

Comment 14 errata-xmlrpc 2009-06-16 22:34:24 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1106 https://rhn.redhat.com/errata/RHSA-2009-1106.html

Comment 16 errata-xmlrpc 2009-06-30 08:06:12 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1132 https://rhn.redhat.com/errata/RHSA-2009-1132.html

Comment 17 errata-xmlrpc 2009-07-14 19:11:20 UTC
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1157 https://rhn.redhat.com/errata/RHSA-2009-1157.html


Note You need to log in before you can comment on or make changes to this bug.