Bug 824997 (CVE-2013-1956) - VUL-1: CVE-2013-1956: kernel user_ns local root exploit
Summary: VUL-1: CVE-2013-1956: kernel user_ns local root exploit
Status: RESOLVED UPSTREAM
Alias: CVE-2013-1956
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-06-14 07:10 UTC by Marcus Meissner
Modified: 2013-06-14 07:11 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-06-14 07:10:55 UTC 
via oss-sec , linux kernel

CVE-2013-1956


The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.

http://www.openwall.com/lists/oss-security/2013/04/16/11

https://github.com/torvalds/linux/commit/3151527ee007b73a0ebd296010f1c0454a919c7d
Comment 1 Marcus Meissner 2013-06-14 07:11:23 UTC 
problem was introduced in 3.8 kernel, earlier kernels are not affected.