286096 – (CVE-2009-3286) Kernel: NFSv4 O_EXCL creates broken (CVE-2009-3286)

Bug 286096 (CVE-2009-3286) - Kernel: NFSv4 O_EXCL creates broken (CVE-2009-3286)

Summary: Kernel: NFSv4 O_EXCL creates broken (CVE-2009-3286)

Status:	RESOLVED FIXED

Alias:	CVE-2009-3286

Product:	Gentoo Security
Classification:	Unclassified
Component:	Kernel (show other bugs)
Hardware:	All Linux

Importance:	High normal (vote)
Assignee:	Gentoo Security

URL:	http://git.kernel.org/?p=linux/kernel...
Whiteboard:	[linux <2.6.19]
Keywords:

Depends on:
Blocks:

Reported:	2009-09-23 14:29 UTC by Alex Legler (RETIRED)
Modified:	2013-09-15 18:41 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alex Legler (RETIRED) archtester

2009-09-23 14:29:29 UTC

CVE-2009-3286 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3286):
  NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does
  not properly clean up an inode when an O_EXCL create fails, which
  causes files to be created with insecure settings such as setuid
  bits, and possibly allows local users to gain privileges, related to
  the execution of the do_open_permission function even when a create
  fails. That also explains why we don't see this problem with
  root...the permission check is always passing there (provided we're
  not root squashing).