linux-cve-announce - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024060345-CVE-2024-36964-d557@gregkh>
Date: Mon,  3 Jun 2024 09:50:46 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/9p: only translate RWX permissions for plain 9P2000

Garbage in plain 9P2000's perm bits is allowed through, which causes it
to be able to set (among others) the suid bit. This was presumably not
the intent since the unix extended bits are handled explicitly and
conditionally on .u.

The Linux kernel CVE team has assigned CVE-2024-36964 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.314 with commit e90bc596a74b
	Fixed in 5.4.276 with commit df1962a19978
	Fixed in 5.10.217 with commit 5a605930e19f
	Fixed in 5.15.159 with commit ad4f65328661
	Fixed in 6.1.91 with commit ca9b5c81f0c9
	Fixed in 6.6.31 with commit e55c601af3b1
	Fixed in 6.8.10 with commit 157d468e34fd
	Fixed in 6.9 with commit cd25e15e57e6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36964
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/9p/vfs_inode.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d
	https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96
	https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c
	https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32
	https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8
	https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3
	https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02
	https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b