CVE-2009-1630
published 2009-05-14CVE-2009-1630: The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not…
PriorityP415medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.48%
39.0th percentile
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | <= 2.6.29.3 | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
CVSS provenance
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
vendor_ubuntu4.9MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v8g3-vj55-5p7v: The nfs_permission function in fs/nfs/dir
ghsa_unreviewed·2022-05-02
CVE-2009-1630 [MEDIUM] GHSA-v8g3-vj55-5p7v: The nfs_permission function in fs/nfs/dir
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
VMware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
vendor_vmware·2009-11-20·CVSS 5.0
CVE-2007-2052 [MEDIUM] VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
VMSA-2009-0016: VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
a. JRE Security Update JRE update to version 1.5.0_20, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-07-02·CVSS 4.9
CVE-2009-1242 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Igor Zhbanov discovered that NFS clients were able to create device nodes
even when root_squash was enabled. An authenticated remote attacker
could create device nodes with open permissions, leading to a loss of
privacy or escalation of privileges. Only Ubuntu 8.10 and 9.04 were
affected. (CVE-2009-1072)
Dan Carpenter discovered that SELinux did not correctly handle
certain network checks when running with compat_net=1. A local
attacker could exploit this to bypass network checks. Default Ubuntu
installations do not enable SELinux, and only Ubuntu 8.10 and 9.04 were
affected. (CVE-2009-1184)
Shaohua Li discovered that memory was not correctly initialized in the
AGP subsystem. A local attacker could potentially re
Red Hat
kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
vendor_redhat·2009-05-09·CVSS 4.4
CVE-2009-1630 [MEDIUM] kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, and 3.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
bugzilla·2009-05-12·CVSS 4.4
CVE-2009-1630 [MEDIUM] CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
Description of problem:
Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it O_READONLY which means EXEC permission will not be checked at that time.
This problem is observed by the following sequence (executed as root):
mount -t nfs4 server:/ /mnt4
echo "ls" >/mnt4/foo
chmod 744 /mnt4/foo
su guest -c "mnt4/foo"
Reference:
http://article.gmane.org/gmane.linux.nfs/26592
Discussion:
This looks like the same problem that was reported in November 2006:
http://linux-nfs.org/pipermail/nfsv4/2006-November/005323.html
http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
http://bugzilla.linux-nfs.org/show_bug.
arXiv
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
arxiv_fulltext·2022-04-26
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
## Abstract
This paper presents a systematic study on the security of modern file systems,
following a vulnerability-centric perspective. Specifically,
we collected 377 file system vulnerabilities committed to the CVE database in the past 20 years.
We characterize them from four dimensions that include why the vulnerabilities appear,
how the vulnerabilities can be exploited, what consequences can arise,
and how the vulnerabilities are fixed. This way, we build a deep understanding of
the attack surfaces faced by file systems, the threats imposed by the attack surfaces,
and the good and bad practices in mitigating the attacks in file systems. We envision that our study
will bring insights toward
http://article.gmane.org/gmane.linux.nfs/26592http://bugzilla.linux-nfs.org/show_bug.cgi?id=131http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.htmlhttp://linux-nfs.org/pipermail/nfsv4/2006-November/005323.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.htmlhttp://secunia.com/advisories/35106http://secunia.com/advisories/35298http://secunia.com/advisories/35394http://secunia.com/advisories/35656http://secunia.com/advisories/35847http://secunia.com/advisories/36051http://secunia.com/advisories/36327http://secunia.com/advisories/37471http://wiki.rpath.com/Advisories:rPSA-2009-0111http://www.debian.org/security/2009/dsa-1809http://www.debian.org/security/2009/dsa-1844http://www.debian.org/security/2009/dsa-1865http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.mandriva.com/security/advisories?name=MDVSA-2009:148http://www.openwall.com/lists/oss-security/2009/05/13/2http://www.redhat.com/support/errata/RHSA-2009-1157.htmlhttp://www.securityfocus.com/archive/1/505254/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/bid/34934http://www.ubuntu.com/usn/usn-793-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/1331http://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=500297https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8543https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9990http://article.gmane.org/gmane.linux.nfs/26592http://bugzilla.linux-nfs.org/show_bug.cgi?id=131http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.htmlhttp://linux-nfs.org/pipermail/nfsv4/2006-November/005323.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.htmlhttp://secunia.com/advisories/35106http://secunia.com/advisories/35298http://secunia.com/advisories/35394http://secunia.com/advisories/35656http://secunia.com/advisories/35847http://secunia.com/advisories/36051http://secunia.com/advisories/36327http://secunia.com/advisories/37471http://wiki.rpath.com/Advisories:rPSA-2009-0111http://www.debian.org/security/2009/dsa-1809http://www.debian.org/security/2009/dsa-1844http://www.debian.org/security/2009/dsa-1865http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.mandriva.com/security/advisories?name=MDVSA-2009:148http://www.openwall.com/lists/oss-security/2009/05/13/2http://www.redhat.com/support/errata/RHSA-2009-1157.htmlhttp://www.securityfocus.com/archive/1/505254/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/bid/34934http://www.ubuntu.com/usn/usn-793-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/1331http://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=500297https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8543https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9990
2009-05-14
Published