NVD

Id
35818  
Name
CVE-2014-8989  
Description
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-11-29  
Modified Date
2017-01-02  
Seq
2014-8989  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
183409 35818 CVE-2014-8989 FEDORA-2015-0517  View
183410 35818 CVE-2014-8989 FEDORA-2015-0515  View
183411 35818 CVE-2014-8989 http://thread.gmane.org/gmane.linux.man/7385/  View
183412 35818 CVE-2014-8989 MDVSA-2015:058  View
183413 35818 CVE-2014-8989 [oss-security] 20141120 Re: Linux user namespaces can bypass group-based restrictions - Linux kernel  View
183414 35818 CVE-2014-8989 71154  View
183415 35818 CVE-2014-8989 USN-2515-1  View
183416 35818 CVE-2014-8989 USN-2516-1  View
183417 35818 CVE-2014-8989 USN-2517-1  View
183418 35818 CVE-2014-8989 USN-2518-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16832 JVNDB-2014-005707 Linux Kernel におけるファイルパーミッションを回避される脆弱性 Linux Kernel は、特定の名前空間のシナリオの、補助グループのメンバーシップ (supplemental group membership) のドロップを適切に制限しないため、ファイルパーミッションを回避される脆弱性が存在します。 CVE-2014-8989 76282 CVE-2014-8989 35818 4.6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005707.html 2014-11-15 2014-12-02 View