512980 – (CVE-2014-4014) Kernel: possible privilege escalation in user namespace (CVE-2014-4014)

Bug 512980 (CVE-2014-4014) - Kernel: possible privilege escalation in user namespace (CVE-2014-4014)

Summary: Kernel: possible privilege escalation in user namespace (CVE-2014-4014)

Status:	RESOLVED FIXED

Alias:	CVE-2014-4014

Product:	Gentoo Security
Classification:	Unclassified
Component:	Kernel (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo Kernel Security

URL:	http://seclists.org/oss-sec/2014/q2/511
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2014-06-11 16:06 UTC by Kristian Fiskerstrand (RETIRED)
Modified:	2021-10-25 00:07 UTC (History)
CC List:	4 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-11 16:06:50 UTC

From patch at $URL 

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example,
inode_capable(inode, CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2014-08-10 14:20:12 UTC

CVE-2014-4014 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4014):
  The capabilities implementation in the Linux kernel before 3.14.8 does not
  properly consider that namespaces are inapplicable to inodes, which allows
  local users to bypass intended chmod restrictions by first creating a user
  namespace, as demonstrated by setting the setgid bit on a file with group
  ownership of root.

Comment 2 John Helmert III archtester

2021-10-25 00:07:03 UTC

Patch in mainline 3.16 onwards