Bug 1416126 (CVE-2017-5551) - CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)
Summary: CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs ...
Status: CLOSED ERRATA
Alias: CVE-2017-5551
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20170109,repor...
Keywords: Security
Depends On: 1371252 1371253 1371254 1371255 1416128 1420840 1420841 1420847 1420848 1420849 1420850
Blocks: 1416132
TreeView+ depends on / blocked
 
Reported: 2017-01-24 16:25 UTC by Adam Mariš
Modified: 2019-06-11 11:13 UTC (History)
32 users (show)

(edit)
A vulnerability was found in the Linux kernel in 'tmpfs' file system. When file permissions are modified via 'chmod' and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via 'setxattr' sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in 'chmod'.
Clone Of:
(edit)
Last Closed: 2019-06-08 03:06:18 UTC


Attachments (Terms of Use)

Description Adam Mariš 2017-01-24 16:25:33 UTC
It was found that fix for CVE-2016-7097 was incomplete as it missed tmpfs.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31

CVE assignment:

http://seclists.org/oss-sec/2017/q1/161

Comment 1 Adam Mariš 2017-01-24 16:31:01 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1416128]

Comment 9 Vladis Dronov 2017-02-09 16:02:32 UTC
[disregard]

Comment 13 Vladis Dronov 2018-09-03 12:59:36 UTC
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix.

Comment 14 Vladis Dronov 2018-09-03 13:00:21 UTC
Notes:

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix:

https://bugzilla.redhat.com/show_bug.cgi?id=1368938


Note You need to log in before you can comment on or make changes to this bug.