NVD

Id
13559  
Name
CVE-2010-2071  
Description
The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-06-16  
Modified Date
2012-03-19  
Seq
2010-2071  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
74878 13559 CVE-2010-2071 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=2f26afba  View
74879 13559 CVE-2010-2071 [linux-kernel] 20100518 [PATCH] btrfs: should add a permission check for setfacl  View
74880 13559 CVE-2010-2071 [oss-security] 20100611 CVE request - kernel: btrfs: prevent users from setting ACLs on files they do not own  View
74881 13559 CVE-2010-2071 [oss-security] 20100614 Re: CVE request - kernel: btrfs: prevent users from setting ACLs on files they do not own  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
39043 JVNDB-2010-004828 Linux kernel の fs/btrfs/acl.c におけるファイルパーミッションを回避される脆弱性 Linux kernel の fs/btrfs/acl.c の btrfs_xattr_set_acl 関数は、ACL 設定前にファイルの所有権をチェックしないため、ファイルパーミッションを回避される脆弱性が存在します。 CVE-2010-2071 44651 CVE-2010-2071 13559 4.6 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-004828.html 2010-05-18 2012-09-25 View