Bug 1416126 (CVE-2017-5551) - CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)
Summary: CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-5551
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering1371252 Engineering1371253 Engineering1371254 Engineering1371255 1416128 Engineering1420840 Engineering1420841 Engineering1420847 Engineering1420848 Engineering1420849 Engineering1420850
Blocks: Embargoed1416132
TreeView+ depends on / blocked
 
Reported: 2017-01-24 16:25 UTC by Adam Mariš
Modified: 2021-02-17 02:43 UTC (History)
32 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A vulnerability was found in the Linux kernel in 'tmpfs' file system. When file permissions are modified via 'chmod' and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via 'setxattr' sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in 'chmod'.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:06:18 UTC

Attachments (Terms of Use)

Description Adam Mariš 2017-01-24 16:25:33 UTC 
It was found that fix for CVE-2016-7097 was incomplete as it missed tmpfs.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31

CVE assignment:

http://seclists.org/oss-sec/2017/q1/161
Comment 1 Adam Mariš 2017-01-24 16:31:01 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1416128]
Comment 9 Vladis Dronov 2017-02-09 16:02:32 UTC 
[disregard]
Comment 13 Vladis Dronov 2018-09-03 12:59:36 UTC 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix.
Comment 14 Vladis Dronov 2018-09-03 13:00:21 UTC 
Notes:

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix:

https://bugzilla.redhat.com/show_bug.cgi?id=1368938
Note You need to log in before you can comment on or make changes to this bug.