clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.5, 4.10, 4.15, 4.20, 5.5, and 7 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in 36fecd740de2d542d2091d65d36554ee2bcf9c65; From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in d717325b5ecf2a40daca85c61923e17f32306179; From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in dc6a664089f10eab0fb36b6e4f705022210191d2; From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in e77078e52fbf018ab986efb3c79065ab35025607; From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in 38628ae06e2a37770cd794802a3f1310cf9846e3; From 427215d85e8d1476da1a86b8d67aceb485eb3631 · fixed in c28f922c9dcee0e4876a2c095939d77fe7e15116; From 4.4.281 · fixed in 4.5; From 4.9.280 · fixed in 4.10; From 4.14.244 · fixed in 4.15; From 4.19.204 · fixed in 4.20; From 5.4.141 · fixed in 5.5; From 5.10.59 · fixed in 5.11; From 5.13.11 · fixed in 5.14
- Linux Linux
5.14
- KernelLinux
From 5.14.0 · fixed in 5.15.190; From 5.16.0 · fixed in 6.1.147; From 6.2.0 · fixed in 6.6.100; From 6.7.0 · fixed in 6.12.40; From 6.13.0 · fixed in 6.15.3