[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240514124939.77984-1-ailiop@suse.com>
Date: Tue, 14 May 2024 14:49:39 +0200
From: Anthony Iliopoulos <ailiop@...e.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Christian Brauner <brauner@...nel.org>,
cve@...nel.org,
linux-kernel@...r.kernel.org
Cc: linux-cve-announce@...r.kernel.org
Subject: Re: CVE-2024-26821: fs: relax mount_setattr() permission checks
On Wed, Apr 17, 2024 at 11:44:04AM +0200, Greg Kroah-Hartman wrote:
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> fs: relax mount_setattr() permission checks
>
> When we added mount_setattr() I added additional checks compared to the
> legacy do_reconfigure_mnt() and do_change_type() helpers used by regular
> mount(2). If that mount had a parent then verify that the caller and the
> mount namespace the mount is attached to match and if not make sure that
> it's an anonymous mount.
>
> The real rootfs falls into neither category. It is neither an anoymous
> mount because it is obviously attached to the initial mount namespace
> but it also obviously doesn't have a parent mount. So that means legacy
> mount(2) allows changing mount properties on the real rootfs but
> mount_setattr(2) blocks this. I never thought much about this but of
> course someone on this planet of earth changes properties on the real
> rootfs as can be seen in [1].
>
> Since util-linux finally switched to the new mount api in 2.39 not so
> long ago it also relies on mount_setattr() and that surfaced this issue
> when Fedora 39 finally switched to it. Fix this.
>
> The Linux kernel CVE team has assigned CVE-2024-26821 to this issue.
This one probably needs to be disputed as it isn't an actual
vulnerability, but rather a fix for the mount_setattr which previously
didn't allow reconfiguring the real rootfs similar to what the mount
syscall always allowed to do.
So it merely brings mount_attr up to par with mount in terms of allowing
the real rootfs to be reconfigured.
Christian, what do you think ?
Regards,
Anthony
Powered by blists - more mailing lists