CVE-2014-8989
published 2014-11-30CVE-2014-8989: The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users…
PriorityP416medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.49%
40.0th percentile
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Affected
182 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.16.7-ckt4-1 (bookworm) | linux 3.16.7-ckt4-1 (bookworm) |
| linux | linux_kernel | <= 3.17.3 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities regression
vendor_ubuntu·2015-03-04·CVSS 2.1
[LOW] Linux kernel (Trusty HWE) vulnerabilities regression
Title: Linux kernel (Trusty HWE) vulnerabilities regression
Summary: USN-2515-1 introduced a regression in the Linux kernel.
USN-2515-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementat
Ubuntu
Linux kernel vulnerabilities regression
vendor_ubuntu·2015-03-04·CVSS 2.1
[LOW] Linux kernel vulnerabilities regression
Title: Linux kernel vulnerabilities regression
Summary: USN-2516-1 introduced a regression in the Linux kernel.
USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in
USN-2516-2 was incomplete. There was an unrelated regression in the use of
the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
L
Ubuntu
Linux kernel vulnerability regression
vendor_ubuntu·2015-02-28·CVSS 2.1
[LOW] Linux kernel vulnerability regression
Title: Linux kernel vulnerability regression
Summary: USN-2516-1 introduced a regression in the Linux kernel.
USN-2516-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing us
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A res
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A res
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014
Red Hat
kernel: Linux user namespaces can bypass group-based restrictions
vendor_redhat·2014-11-15·CVSS 4.6
CVE-2014-8989 [MEDIUM] kernel: Linux user namespaces can bypass group-based restrictions
kernel: Linux user namespaces can bypass group-based restrictions
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Statement: Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package:
Debian
CVE-2014-8989: linux - The Linux kernel through 3.17.4 does not properly restrict dropping of supplemen...
vendor_debian·2014·CVSS 4.6
CVE-2014-8989 [MEDIUM] CVE-2014-8989: linux - The Linux kernel through 3.17.4 does not properly restrict dropping of supplemen...
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Scope: local
bookworm: resolved (fixed in 3.16.7-ckt4-1)
bullseye: resolved (fixed in 3.16.7-ckt4-1)
forky: resolved (fixed in 3.16.7-ckt4-1)
sid: resolved (fixed in 3.16.7-ckt4-1)
trixie: resolved (fixed in 3.16.7-ckt4-1)
GHSA
GHSA-86g9-4xm6-2vw3: The Linux kernel through 3
ghsa_unreviewed·2022-05-17
CVE-2014-8989 [MEDIUM] GHSA-86g9-4xm6-2vw3: The Linux kernel through 3
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
OSV
linux vulnerabilities
osv·2015-03-04·CVSS 2.1
[LOW] linux vulnerabilities
linux vulnerabilities
USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in
USN-2516-2 was incomplete. There was an unrelated regression in the use of
the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information
OSV
linux vulnerability
osv·2015-02-28·CVSS 2.1
[LOW] linux vulnerability
linux vulnerability
USN-2516-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Spa
OSV
linux vulnerabilities
osv·2015-02-26·CVSS 2.1
CVE-2015-0239 [LOW] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A restriction bypass was discovered in iptables when conntrack rules are
specif
OSV
linux-lts-utopic vulnerabilities
osv·2015-02-26·CVSS 2.1
CVE-2015-0239 [LOW] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A restriction bypass was discovered in iptables when conntrack rules
Kernel
userns: Document what the invariant required for safe unprivileged mappings.
kernel_security·2014-12-05·CVSS 4.6
CVE-2014-8989 [MEDIUM] userns: Document what the invariant required for safe unprivileged mappings.
userns: Document what the invariant required for safe unprivileged mappings.
The rule is simple. Don't allow anything that wouldn't be allowed
without unprivileged mappings.
It was previously overlooked that establishing gid mappings would
allow dropping groups and potentially gaining permission to files and
directories that had lesser permissions for a specific group than for
all other users.
This is the rule needed to fix CVE-2014-8989 and prevent any other
security issues with new_idmap_permitted.
The reason for this rule is that the unix permission model is old and
there are programs out there somewhere that take advantage of every
little corner of it. So allowing a uid or gid mapping to be
established without privielge that would allow anything that would not
be allowed without th
Kernel
userns: Don't allow unprivileged creation of gid mappings
kernel_security·2014-12-05·CVSS 4.6
CVE-2014-8989 [MEDIUM] userns: Don't allow unprivileged creation of gid mappings
userns: Don't allow unprivileged creation of gid mappings
As any gid mapping will allow and must allow for backwards
compatibility dropping groups don't allow any gid mappings to be
established without CAP_SETGID in the parent user namespace.
For a small class of applications this change breaks userspace
and removes useful functionality. This small class of applications
includes tools/testing/selftests/mount/unprivilged-remount-test.c
Most of the removed functionality will be added back with the addition
of a one way knob to disable setgroups. Once setgroups is disabled
setting the gid_map becomes as safe as setting the uid_map.
For more common applications that set the uid_map and the gid_map
with privilege this change will have no affect.
This is part of a fix for CVE-2014-8989.
Cc
Kernel
userns: Don't allow setgroups until a gid mapping has been setablished
kernel_security·2014-12-05·CVSS 4.6
CVE-2014-8989 [MEDIUM] userns: Don't allow setgroups until a gid mapping has been setablished
userns: Don't allow setgroups until a gid mapping has been setablished
setgroups is unique in not needing a valid mapping before it can be called,
in the case of setgroups(0, NULL) which drops all supplemental groups.
The design of the user namespace assumes that CAP_SETGID can not actually
be used until a gid mapping is established. Therefore add a helper function
to see if the user namespace gid mapping has been established and call
that function in the setgroups permission check.
This is part of the fix for CVE-2014-8989, being able to drop groups
without privilege using user namespaces.
Cc: [email protected]
Reviewed-by: Andy Lutomirski
Signed-off-by: "Eric W. Biederman"
Kernel
userns: Check euid no fsuid when establishing an unprivileged uid mapping
kernel_security·2014-12-05·CVSS 4.6
CVE-2014-8989 [MEDIUM] userns: Check euid no fsuid when establishing an unprivileged uid mapping
userns: Check euid no fsuid when establishing an unprivileged uid mapping
setresuid allows the euid to be set to any of uid, euid, suid, and
fsuid. Therefor it is safe to allow an unprivileged user to map
their euid and use CAP_SETUID privileged with exactly that uid,
as no new credentials can be obtained.
I can not find a combination of existing system calls that allows setting
uid, euid, suid, and fsuid from the fsuid making the previous use
of fsuid for allowing unprivileged mappings a bug.
This is part of a fix for CVE-2014-8989.
Cc: [email protected]
Reviewed-by: Andy Lutomirski
Signed-off-by: "Eric W. Biederman"
OSV
CVE-2014-8989: The Linux kernel through 3
osv·2014-11-30·CVSS 4.6
CVE-2014-8989 [MEDIUM] CVE-2014-8989: The Linux kernel through 3
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Kernel
userns: Only allow the creator of the userns unprivileged mappings
kernel_security·2014-11-26·CVSS 4.6
CVE-2014-8989 [MEDIUM] userns: Only allow the creator of the userns unprivileged mappings
userns: Only allow the creator of the userns unprivileged mappings
If you did not create the user namespace and are allowed
to write to uid_map or gid_map you should already have the necessary
privilege in the parent user namespace to establish any mapping
you want so this will not affect userspace in practice.
Limiting unprivileged uid mapping establishment to the creator of the
user namespace makes it easier to verify all credentials obtained with
the uid mapping can be obtained without the uid mapping without
privilege.
Limiting unprivileged gid mapping establishment (which is temporarily
absent) to the creator of the user namespace also ensures that the
combination of uid and gid can already be obtained without privilege.
This is part of the fix for CVE-2014-8989.
Cc: stable@vger.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions [fedora-all]
bugzilla·2014-12-04·CVSS 4.6
CVE-2014-8989 [MEDIUM] CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions [fedora-all]
CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple support
Bugzilla
CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions
bugzilla·2014-12-04·CVSS 4.6
CVE-2014-8989 [MEDIUM] CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions
CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions
Linux kernel built with the User namespaces(CONFIG_USER_NS) support is vulnerable to a potential 'group' privilege escalation flaw. It could occur when unsharing parts of process' execution context from other processes via unshare(2) or clone(2) calls.
A user/process able to unshare parts of its execution context could use this flaw to gain extra 'group' privileges on a system.
References:
-> http://thread.gmane.org/gmane.linux.man/7385/
-> http://www.openwall.com/lists/oss-security/2014/11/20/4
Discussion:
Statement:
Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
---
Created kernel tracking bug
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.htmlhttp://thread.gmane.org/gmane.linux.man/7385/http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/11/20/4http://www.securityfocus.com/bid/71154http://www.ubuntu.com/usn/USN-2515-1http://www.ubuntu.com/usn/USN-2516-1http://www.ubuntu.com/usn/USN-2517-1http://www.ubuntu.com/usn/USN-2518-1http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.htmlhttp://thread.gmane.org/gmane.linux.man/7385/http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/11/20/4http://www.securityfocus.com/bid/71154http://www.ubuntu.com/usn/USN-2515-1http://www.ubuntu.com/usn/USN-2516-1http://www.ubuntu.com/usn/USN-2517-1http://www.ubuntu.com/usn/USN-2518-1
2014-11-30
Published