Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 512980 (CVE-2014-4014)

Summary: Kernel: possible privilege escalation in user namespace (CVE-2014-4014)
Product: Gentoo Security Reporter: Kristian Fiskerstrand (RETIRED) <k_f>
Component: KernelAssignee: Gentoo Kernel Security <security-kernel>
Severity: normal CC: axiator, cyberbat83, kernel, kfm
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Package list:
Runtime testing required: ---

Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-06-11 16:06:50 UTC
From patch at $URL 

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example,
inode_capable(inode, CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2014-08-10 14:20:12 UTC
CVE-2014-4014 (
  The capabilities implementation in the Linux kernel before 3.14.8 does not
  properly consider that namespaces are inapplicable to inodes, which allows
  local users to bypass intended chmod restrictions by first creating a user
  namespace, as demonstrated by setting the setgid bit on a file with group
  ownership of root.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-10-25 00:07:03 UTC
Patch in mainline 3.16 onwards