CVE-2009-3556: Low severity Linux Linux kernel vulnerability
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when NPort ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vportcreate and (2) vportdelete files under /sys/class/scsihost/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
Other sources
Description of problem:
The qla2xxx driver now supports NPIV which adds two new sysfs pseduofiles to the SCSI host attributes:
w--w--w- root root /sys/class/scsihost/host1/vportcreate w--w--w- root root /sys/class/scsihost/host1/vportdelete w--w--w- root root /sys/class/scsihost/host2/vportcreate w--w--w- root root /sys/class/scsihost/host2/vportdelete
These file default to world writable (SIWUGO/0222). Upstream uses SIWUSR (0644) for these files although they've moved around a bit - the equivalent attributes are created from drivers/scsi/scsitransportfc.c now.
Version-Release number of selected component (if applicable): 2.6.18-63.el5 onwards
How reproducible: 100% on systems that loads qla2xxx on NPIV capable hardware.
Steps to Reproduce: 1. ls -l /sys/class/scsihost/<a qla2xxx host>/vport ls -l /sys/class/scsihost/<a qla2xxx host>/vportid ls -l /sys/class/scsihost/<a qla2xxx host>/vportdisable ls -l /sys/class/scsihost/<a qla2xxx host>/symbolicportname
Actual results: --w--w--w- root root /sys/class/scsihost/host1/vportcreate --w--w--w- root root /sys/class/scsihost/host1/vportdelete --w--w--w- root root /sys/class/scsihost/host2/vportcreate --w--w--w- root root /sys/class/scsihost/host2/vportdelete etc.
Expected results: -rw-r--r-- root root /sys/class/scsihost/host1/vportcreate -rw-r--r-- root root /sys/class/scsihost/host1/vportdelete -rw-r--r-- root root /sys/class/scsihost/host2/vportcreate -rw-r--r-- root root /sys/class/scsihost/host2/vportdelete etc.
Additional info:
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3556?
CVE-2009-3556 has a moderate severity level due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2009-3556?
To fix CVE-2009-3556, you should restrict the permissions of the vport_create and vport_delete files under /sys/class/scsi_host/.
Which systems are affected by CVE-2009-3556?
CVE-2009-3556 affects Linux Kernel 2.6.18 and Red Hat Enterprise Linux version 5.
What kind of vulnerability is CVE-2009-3556?
CVE-2009-3556 is a permission vulnerability that allows world-writable access to certain driver files.
Is CVE-2009-3556 a local or remote vulnerability?
CVE-2009-3556 is considered a local vulnerability as it requires local access to exploit the permissions issue.