CVE-2009-1630: Medium severity Linux Linux kernel vulnerability
Description of problem: Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it OREADONLY which means EXEC permission will not be checked at that time.
This problem is observed by the following sequence (executed as root):
mount -t nfs4 server:/ /mnt4 echo "ls" >/mnt4/foo chmod 744 /mnt4/foo su guest -c "mnt4/foo"
Reference: http://article.gmane.org/gmane.linux.nfs/26592
Other sources
The nfspermission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomicopen is available, does not check execute (aka EXEC or MAYEXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1630?
The severity of CVE-2009-1630 is classified as medium risk due to potential unauthorized file access.
How do I fix CVE-2009-1630?
To fix CVE-2009-1630, ensure that your system is updated to a kernel version that contains the appropriate patch.
What systems are affected by CVE-2009-1630?
CVE-2009-1630 affects various Linux distributions, including specific versions of Debian, Ubuntu, openSUSE, and VMware ESX.
What does CVE-2009-1630 exploit in the Linux kernel?
CVE-2009-1630 exploits the lack of permission checking during file execution due to atomic open mechanisms.
Can I verify if my system is vulnerable to CVE-2009-1630?
You can verify vulnerability to CVE-2009-1630 by checking your Linux kernel version against the versions listed in the vulnerability report.