Bug 900392 (CVE-2014-7975)

Summary: VUL-0: CVE-2014-7975: kernel-source: unmount denial of service
Product: [Novell Products] SUSE Security Incidents Reporter: Victor Pereira <vpereira>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: mhocko, mszeredi
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: proposed patch
testcase

Description Victor Pereira 2014-10-09 07:44:40 UTC
Created attachment 609413 [details]
proposed patch

Accessing do_remount_sb should require global CAP_SYS_ADMIN, but
only one of the two call sites was appropriately protected.

patch and proof of concept included:

references:

http://thread.gmane.org/gmane.linux.kernel.stable/109312
Comment 1 Victor Pereira 2014-10-09 07:47:23 UTC
Created attachment 609415 [details]
testcase
Comment 2 Swamp Workflow Management 2014-10-09 22:00:13 UTC
bugbot adjusting priority
Comment 4 Michal Marek 2014-11-07 14:55:35 UTC
This is a1480dcc3c706e309a88884723446f2e84fedd5b now. It has been backported to 3.12.32, so SLE12 is covered.
Comment 5 Miklos Szeredi 2014-12-01 15:31:35 UTC
bug introduced in v3.8 by

   0c55cfc4166d vfs: Allow unprivileged manipulation of the mount namespace.

Not vulnerable:

  SLE11
  openSUSE-12.3

Already fixed:

  HEAD
  SLE12
  openSUSE-13.2

Fix pushed to:

  openSUSE-13.1
Comment 6 Swamp Workflow Management 2014-12-21 12:10:47 UTC
openSUSE-SU-2014:1677-1: An update that solves 31 vulnerabilities and has 12 fixes is now available.

Category: security (important)
Bug References: 818966,835839,853040,856659,864375,865882,873790,875051,881008,882639,882804,883518,883724,883948,883949,884324,887046,887082,889173,890114,891689,892490,893429,896382,896385,896390,896391,896392,896689,897736,899785,900392,902346,902349,902351,904013,904700,905100,905744,907818,908163,909077,910251
CVE References: CVE-2013-2891,CVE-2013-2898,CVE-2014-0181,CVE-2014-0206,CVE-2014-1739,CVE-2014-3181,CVE-2014-3182,CVE-2014-3184,CVE-2014-3185,CVE-2014-3186,CVE-2014-3673,CVE-2014-3687,CVE-2014-3688,CVE-2014-4171,CVE-2014-4508,CVE-2014-4608,CVE-2014-4611,CVE-2014-4943,CVE-2014-5077,CVE-2014-5206,CVE-2014-5207,CVE-2014-5471,CVE-2014-5472,CVE-2014-6410,CVE-2014-7826,CVE-2014-7841,CVE-2014-7975,CVE-2014-8133,CVE-2014-8709,CVE-2014-9090,CVE-2014-9322
Sources used:
openSUSE 13.1 (src):    cloop-2.639-11.16.1, crash-7.0.2-2.16.1, hdjmod-1.28-16.16.1, ipset-6.21.1-2.20.1, iscsitarget-1.4.20.3-13.16.1, kernel-docs-3.11.10-25.2, kernel-source-3.11.10-25.1, kernel-syms-3.11.10-25.1, ndiswrapper-1.58-16.1, pcfclock-0.44-258.16.1, vhba-kmp-20130607-2.17.1, virtualbox-4.2.18-2.21.1, xen-4.3.2_02-30.1, xtables-addons-2.3-2.16.1
Comment 7 Marcus Meissner 2015-03-05 08:03:22 UTC
released