NVD

Id
36309  
Name
CVE-2014-9710  
Description
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2015-05-27  
Modified Date
2016-12-30  
Seq
2014-9710  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185708 36309 CVE-2014-9710 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339  View
185709 36309 CVE-2014-9710 SUSE-SU-2015:1224  View
185710 36309 CVE-2014-9710 SUSE-SU-2015:1489  View
185711 36309 CVE-2014-9710 [oss-security] 20150324 CVE request Linux kernel: fs: btrfs: non-atomic xattr replace operation  View
185712 36309 CVE-2014-9710 1032418  View
185713 36309 CVE-2014-9710 https://bugzilla.redhat.com/show_bug.cgi?id=1205079  View
185714 36309 CVE-2014-9710 https://github.com/torvalds/linux/commit/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19186 JVNDB-2014-008063 Linux Kernel の Btrfs の実装における ACL 設定を回避される脆弱性 Linux Kernel の Btrfs の実装は、可視の拡張属性 (xattr) の状態がリクエストされた置換と同一であることを確認しないため、ACL 設定を回避され、権限を取得される脆弱性が存在します。 CVE-2014-9710 77003 CVE-2014-9710 36309 6.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008063.html 2014-11-21 2015-05-29 View