In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inodesetsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for _vfssetxattrnoperm() states: * This function requires the caller to lock the inode's imutex before it * is executed. It also assumes that the caller will make the appropriate * permission checks. nfsdsetattr() does do permissions checking via fhverify() and nfsdpermission(), but those don't do all the same permissions checks that are done by securityinodesetxattr() and its related LSM hooks do. Since nfsdsetattr() is the only consumer of securityinodesetsecctx(), simplest solution appears to be to replace the call to _vfssetxattrnoperm() with a call to _vfssetxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-7.7", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-buildinfo-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-buildinfo-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-6.11.0-7-generic-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-64k-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-lib-rust-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-extra-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-ipu6-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-ipu7-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-iwlwifi-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-usbio-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-vision-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-cloud-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-headers-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-cloud-tools-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-aws-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-extra-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-cloud-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-headers-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-buildinfo-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-cloud-tools-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-headers-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-unsigned-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-unsigned-6.11.0-1003-azure-dbgsym" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-extra-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-iwlwifi-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-tools-6.11.0-1003-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1001.1", "binary_name": "linux-buildinfo-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-gcp-headers-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-gcp-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-headers-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-gcp-dbgsym" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-extra-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-tools-6.11.0-1001-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-cloud-tools-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-cloud-tools-common" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-headers-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-common" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-host" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-iwlwifi-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1004.4", "binary_name": "linux-buildinfo-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-buildinfo-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-headers-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-headers-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-dbgsym" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-extra-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-extra-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-oracle-headers-6.11.0-1004" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-oracle-tools-6.11.0-1004" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-tools-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-tools-6.11.0-1004-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1003.3", "binary_name": "linux-buildinfo-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-headers-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-6.11.0-1003-raspi-dbgsym" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-raspi-headers-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-raspi-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-tools-6.11.0-1003-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1001.1", "binary_name": "linux-buildinfo-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-cloud-tools-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-headers-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-realtime-dbgsym" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-extra-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-cloud-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-headers-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-tools-6.11.0-1001-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-buildinfo-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-headers-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-image-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-image-6.11.0-8-generic-dbgsym" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-modules-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-riscv-headers-6.11.0-8" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-riscv-tools-6.11.0-8" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-tools-6.11.0-8-generic" } ] }