CVE-2011-0006: Low severity linux kernel vulnerability
If securityfilterruleinit() doesn't return a rule, then not everything is as fine as the return code implies. This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.
Adding an empty LSM rule causes imamatchrules() to always succeed, ignoring any remaining rules. default IMA TCB policy: # PROCSUPERMAGIC dontmeasure fsmagic=0x9fa0 # SYSFSMAGIC dontmeasure fsmagic=0x62656572 # DEBUGFSMAGIC dontmeasure fsmagic=0x64626720 # TMPFSMAGIC dontmeasure fsmagic=0x01021994 # SECURITYFSMAGIC dontmeasure fsmagic=0x73636673 < LSM specific rule > dontmeasure objtype=varlogt measure func=BPRMCHECK measure func=FILEMMAP mask=MAYEXEC measure func=FILECHECK mask=MAYREAD uid=0 Thus without the patch, with the boot parameters 'tcb selinux=0', adding the above 'dontmeasure objtype=varlogt' rule to the default IMA TCB measurement policy, would result in nothing being measured. The patch prevents the default TCB policy from being replaced.
Upstream commit: http://git.kernel.org/linus/867c20265459d30a01b021a9c1e81fb4c5832aa9
Introduced in 2.6.30-rc1 4af4662f
Other sources
The imalsmruleinit function in security/integrity/ima/imapolicy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0006?
CVE-2011-0006 has a medium severity rating as it can cause improper access control under certain configurations.
How do I fix CVE-2011-0006?
To fix CVE-2011-0006, ensure that Linux Security Module (LSM) support is enabled at runtime.
What systems are affected by CVE-2011-0006?
CVE-2011-0006 affects various versions of the Linux kernel, specifically those prior to 2.6.37.
What impact does CVE-2011-0006 have on system security?
CVE-2011-0006 can lead to security flaws that bypass security rules, potentially allowing unauthorized actions.
Is there a patch available for CVE-2011-0006?
Yes, a patch for CVE-2011-0006 is included in Linux kernel version 2.6.37 and later.