binfmt_misc: restore write access before closing files opened by open_exec()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.10, 4.15, 4.20, 5.5, 5.11, and 6 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail. Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in 54274ff90488b6c0f595a6518faed3cf0bc966eb; From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in 480ac88431703f2adbb8e6b5bd73c3f3cf9f3d7f; From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in fbab8c08e1a6dbaef81e22d672a7647553101d16; From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in 6cce7bc7fac8471c832696720d9c8f2a976d9c54; From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in e785f552ab04dbca01d31f0334f4561240b04459; From e7850f4d844e0acfac7e570af611d89deade3146 · fixed in 90f601b497d76f40fa66795c3ecf625b6aced9fd; From 4.9.262 · fixed in 4.10; From 4.14.226 · fixed in 4.15; From 4.19.181 · fixed in 4.20; From 5.4.106 · fixed in 5.5; From 5.10.24 · fixed in 5.11; From 5.11.7 · fixed in 5.12
- Linux Linux
5.12
- KernelLinux
From 5.12.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.78; From 6.13.0 · fixed in 6.17.9