CVE

Id
76290  
CVE No.
CVE-2014-8989  
Status
Candidate  
Description
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.  
Phase
Assigned (20141119)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
703230 76290 CVE-2014-8989 MLIST:[oss-security] 20141120 Re: Linux user namespaces can bypass group-based restrictions - Linux kernel  View
703231 76290 CVE-2014-8989 URL:http://www.openwall.com/lists/oss-security/2014/11/20/4  View
703232 76290 CVE-2014-8989 CONFIRM:http://thread.gmane.org/gmane.linux.man/7385/  View
703233 76290 CVE-2014-8989 FEDORA:FEDORA-2015-0515  View
703234 76290 CVE-2014-8989 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html  View
703235 76290 CVE-2014-8989 FEDORA:FEDORA-2015-0517  View
703236 76290 CVE-2014-8989 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html  View
703237 76290 CVE-2014-8989 MANDRIVA:MDVSA-2015:058  View
703238 76290 CVE-2014-8989 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2015:058  View
703239 76290 CVE-2014-8989 UBUNTU:USN-2515-1  View
703240 76290 CVE-2014-8989 URL:http://www.ubuntu.com/usn/USN-2515-1  View
703241 76290 CVE-2014-8989 UBUNTU:USN-2516-1  View
703242 76290 CVE-2014-8989 URL:http://www.ubuntu.com/usn/USN-2516-1  View
703243 76290 CVE-2014-8989 UBUNTU:USN-2517-1  View
703244 76290 CVE-2014-8989 URL:http://www.ubuntu.com/usn/USN-2517-1  View
703245 76290 CVE-2014-8989 UBUNTU:USN-2518-1  View
703246 76290 CVE-2014-8989 URL:http://www.ubuntu.com/usn/USN-2518-1  View
703247 76290 CVE-2014-8989 BID:71154  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16691 JVNDB-2014-005566 DigitalVidhya Online Examination System の Photo 機能における任意のコードを実行される脆弱性 DigitalVidhya Online Examination System の Photo 機能には、ファイルをアップロードされることにより、任意のコードを実行される脆弱性が存在します。 CVE-2014-8997 76290 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005566.html  View