Bug 960281 - (CVE-2015-8660) VUL-0: CVE-2015-8660: kernel-source: Permission bypass on overlayfs during copy_up
(CVE-2015-8660)
VUL-0: CVE-2015-8660: kernel-source: Permission bypass on overlayfs during co...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/160070/
CVSSv2:RedHat:CVE-2015-8660:6.0:(AV:L...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-12-28 13:39 UTC by Victor Pereira
Modified: 2016-08-01 13:02 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2015-12-28 13:39:38 UTC
rh#1291329

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through
4.3.3 attempts to merge distinct setattr operations, which allows local users to
bypass intended access restrictions and modify the attributes of arbitrary
overlay files via a crafted application.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1291329
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8660
http://seclists.org/oss-sec/2015/q4/575
http://www.openwall.com/lists/oss-security/2015/12/23/5
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8660.html
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545
https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545
Comment 1 Jeff Mahoney 2015-12-28 15:59:36 UTC
SLE releases prior to SLE12 don't have overlayfs at all.  SLE12 is unaffected.

openSUSE 13.1 and 13.2 share a similar, older, version of overlayfs and are unaffected.

SLE12 SP1 is affected. openSUSE Tumbleweed is affected. SLERT may be affected.

I've submitted fixes for both SLE12 SP1 and stable.  Passing on to Mike.
Comment 2 Swamp Workflow Management 2015-12-28 23:00:12 UTC
bugbot adjusting priority
Comment 3 Mike Galbraith 2015-12-29 04:09:14 UTC
(In reply to Jeff Mahoney from comment #1)
> SLE releases prior to SLE12 don't have overlayfs at all.  SLE12 is
> unaffected.
> 
> openSUSE 13.1 and 13.2 share a similar, older, version of overlayfs and are
> unaffected.
> 
> SLE12 SP1 is affected. openSUSE Tumbleweed is affected. SLERT may be
> affected.
> 
> I've submitted fixes for both SLE12 SP1 and stable.  Passing on to Mike.

Picked up via merge.  Passing back to security.
Comment 4 Michal Hocko 2015-12-29 16:01:06 UTC
TD branches are not affected as per comment 1
Comment 6 Swamp Workflow Management 2016-02-25 20:22:04 UTC
SUSE-SU-2016:0585-1: An update that solves 17 vulnerabilities and has 54 fixes is now available.

Category: security (important)
Bug References: 812259,855062,867583,899908,902606,924919,935087,937261,937444,938577,940338,940946,941363,942476,943989,944749,945649,947953,949440,949936,950292,951199,951392,951615,952579,952976,954992,955118,955354,955654,956514,956708,957525,957988,957990,958463,958886,958951,959090,959146,959190,959257,959364,959399,959436,959463,959629,960221,960227,960281,960300,961202,961257,961500,961509,961516,961588,961971,962336,962356,962788,962965,963449,963572,963765,963767,963825,964230,964821,965344,965840
CVE References: CVE-2013-7446,CVE-2015-0272,CVE-2015-5707,CVE-2015-7550,CVE-2015-7799,CVE-2015-8215,CVE-2015-8539,CVE-2015-8543,CVE-2015-8550,CVE-2015-8551,CVE-2015-8569,CVE-2015-8575,CVE-2015-8660,CVE-2015-8767,CVE-2015-8785,CVE-2016-0723,CVE-2016-2069
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    kernel-default-3.12.53-60.30.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    kernel-docs-3.12.53-60.30.2, kernel-obs-build-3.12.53-60.30.2
SUSE Linux Enterprise Server 12-SP1 (src):    kernel-default-3.12.53-60.30.1, kernel-source-3.12.53-60.30.1, kernel-syms-3.12.53-60.30.1, kernel-xen-3.12.53-60.30.1, lttng-modules-2.7.0-3.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    kernel-ec2-3.12.53-60.30.1
SUSE Linux Enterprise Live Patching 12 (src):    kgraft-patch-SLE12-SP1_Update_3-1-2.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    kernel-default-3.12.53-60.30.1, kernel-source-3.12.53-60.30.1, kernel-syms-3.12.53-60.30.1, kernel-xen-3.12.53-60.30.1
Comment 8 Marcus Meissner 2016-08-01 13:02:14 UTC
released