Bug 512980 (CVE-2014-4014)

Summary:	Kernel: possible privilege escalation in user namespace (CVE-2014-4014)
Product:	Gentoo Security	Reporter:	Kristian Fiskerstrand (RETIRED) <k_f>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED FIXED
Severity:	normal	CC:	axiator, cyberbat83, kernel, kfm
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://seclists.org/oss-sec/2014/q2/511
Whiteboard:
Package list:		Runtime testing required:	---

Description Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-11 16:06:50 UTC

From patch at $URL 

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example,
inode_capable(inode, CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2014-08-10 14:20:12 UTC

CVE-2014-4014 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4014):
  The capabilities implementation in the Linux kernel before 3.14.8 does not
  properly consider that namespaces are inapplicable to inodes, which allows
  local users to bypass intended chmod restrictions by first creating a user
  namespace, as demonstrated by setting the setgid bit on a file with group
  ownership of root.

Comment 2 John Helmert III archtester

2021-10-25 00:07:03 UTC

Patch in mainline 3.16 onwards