Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before 36fecd740de2d542d2091d65d36554ee2bcf9c65; affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before d717325b5ecf2a40daca85c61923e17f32306179; affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before dc6a664089f10eab0fb36b6e4f705022210191d2; affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before e77078e52fbf018ab986efb3c79065ab35025607; affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before 38628ae06e2a37770cd794802a3f1310cf9846e3; affected 427215d85e8d1476da1a86b8d67aceb485eb3631 before c28f922c9dcee0e4876a2c095939d77fe7e15116; affected c6e8810d25295acb40a7b69ed3962ff181919571; affected e3eee87c846dc47f6d8eb6d85e7271f24122a279; affected 517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce; affected 963d85d630dabe75a3cfde44a006fec3304d07b8; affected 812f39ed5b0b7f34868736de3055c92c7c4cf459; affected 6a002d48a66076524f67098132538bef17e8445e; affected 41812f4b84484530057513478c6770590347dc30; affected 4.4.281 before 4.5; affected 4.9.280 before 4.10; affected 4.14.244 before 4.15; affected 4.19.204 before 4.20; affected 5.4.141 before 5.5; affected 5.10.59 before 5.11; affected 5.13.11 before 5.14 |
| Linux / Linux | affected 5.14; unaffected 0 before 5.14; unaffected 5.15.190 through 5.15.*; unaffected 6.1.147 through 6.1.*; unaffected 6.6.100 through 6.6.*; unaffected 6.12.40 through 6.12.*; unaffected 6.15.3 through 6.15.*; unaffected 6.16 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65
- https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179
- https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2
- https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607
- https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3
- https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116
ADP enrichment
No English description supplied.
No English description supplied.
No English description supplied.
No references supplied.