NVD Vulnerability Detail

CVE-2014-9710

Summary	The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
Publication Date	May 27, 2015, 7:59 p.m.
Registration Date	Jan. 26, 2021, 3:23 p.m.
Last Update	Nov. 21, 2024, 11:21 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339	Broken Link Vendor Advisory
2	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339	Broken Link Vendor Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html	Mailing List Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2015/03/24/11	Mailing List
8	http://www.openwall.com/lists/oss-security/2015/03/24/11	Mailing List
9	http://www.securitytracker.com/id/1032418	Broken Link Third Party Advisory VDB Entry
10	http://www.securitytracker.com/id/1032418	Broken Link Third Party Advisory VDB Entry
11	https://bugzilla.redhat.com/show_bug.cgi?id=1205079	Issue Tracking Third Party Advisory
12	https://bugzilla.redhat.com/show_bug.cgi?id=1205079	Issue Tracking Third Party Advisory
13	https://github.com/torvalds/linux/commit/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339	Patch
14	https://github.com/torvalds/linux/commit/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-362	競合状態	https://cwe.mitre.org/data/definitions/362.html

JVN Vulnerability Information

Linux Kernel の Btrfs の実装における ACL 設定を回避される脆弱性

Title	Linux Kernel の Btrfs の実装における ACL 設定を回避される脆弱性
Summary	Linux Kernel の Btrfs の実装は、可視の拡張属性 (xattr) の状態がリクエストされた置換と同一であることを確認しないため、ACL 設定を回避され、権限を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、以下のタイミングの標準のファイルシステム操作を介して、ACL 設定を回避され、権限を取得される可能性があります。 (1) 競合状態に関連した拡張属性置換 (xattr-replacement) タイムウィンドウ時 (2) データが合わないために失敗する拡張属性置換 (xattr-replacement) の試行後
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 21, 2014, midnight
Registration Date	May 29, 2015, 4:20 p.m.
Last Update	May 29, 2015, 4:20 p.m.

Affected System

Linux

Linux Kernel 3.19 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-9710	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9710
National Vulnerability Database (NVD)
2	CVE-2014-9710	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9710

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-362	https://jvndb.jvn.jp/ja/cwe/CWE-362.html

ベンダー情報

No	Name	URL
GitHub
1	Btrfs: make xattr replace operations atomic	https://github.com/torvalds/linux/commit/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339
Linux Kernel
2	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
3	Btrfs: make xattr replace operations atomic	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339
Red Hat Bugzilla
4	Bug 1205079	https://bugzilla.redhat.com/show_bug.cgi?id=1205079

Change Log

No	Changed Details	Date of change
0	[2015年05月29日] 掲載	Feb. 17, 2018, 10:37 a.m.