Bug 825003 (CVE-2013-1957) - VUL-1: CVE-2013-1957: kernel: read only mount bypass via mount namespaces
Summary: VUL-1: CVE-2013-1957: kernel: read only mount bypass via mount namespaces
Status: RESOLVED UPSTREAM
Alias: CVE-2013-1957
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-06-14 07:15 UTC by Marcus Meissner
Modified: 2013-06-14 07:16 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-06-14 07:15:52 UTC 
is public, via kernel commit and oss-sec

CVE-2013-1957

The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.

https://github.com/torvalds/linux/commit/132c94e31b8bca8ea921f9f96a57d684fa4ae0a9
http://www.openwall.com/lists/oss-security/2013/04/16/11
Comment 1 Marcus Meissner 2013-06-14 07:16:40 UTC 
this is a problem caused by the unprivileged namespaces in Linux kernel 3.8 and does not affect older kernels.