linux kernel 2.6.34 xfs swapext ioctl issue

2010.09.13

Credit: Eugene Teo

Risk: Low

Local: Yes

Remote: No

CVE: CVE-2010-2226

CWE: CWE-20

CVSS Base Score: 1.9/10

Impact Subscore: 2.9/10

Exploitability Subscore: 3.4/10

Exploit range: Local

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by 
user "bar" into a file owned by "foo" and subsequently reading it. It 
does so by checking that the file descriptors passed to the ioctl are 
also opened for reading.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=605158
http://archives.free.net.ph/message/20100616.130710.301704aa.en.html
http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html

Thanks, Eugene

References:

https://bugzilla.redhat.com/show_bug.cgi?id=605158

http://www.securityfocus.com/bid/40920

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35

http://marc.info/?l=oss-security&m=127687486331790&w=2

http://marc.info/?l=oss-security&m=127677135609357&w=2

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1817176a86352f65210139d4c794ad2d19fc6b63

http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html

http://archives.free.net.ph/message/20100616.130710.301704aa.en.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

linux kernel 2.6.34 xfs swapext ioctl issue

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.