CVE-2016-1237: Medium severity linux kernel vulnerability
It was found that nfsd is missing permissions check when setting ACL, which allows local users to gain access to any file by setting ACL.
Introduced in v3.14-rc1 by following commit:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ac7249ea5a0ceef9f8269f63f33cc873c3fac61
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=999653786df6954a31044528ac3f7a5dadca08f4
Prerequisite for the fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485e71e8fb6356c08c7fc6bcce4bf02c9a9a663f
CVE request:
http://seclists.org/oss-sec/2016/q2/602
Other sources
nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-1237?
CVE-2016-1237 is a vulnerability in nfsd in the Linux kernel that allows local users to bypass file-permission restrictions.
How severe is CVE-2016-1237?
CVE-2016-1237 has a severity rating of high with a value of 7.
Which versions of Linux are affected by CVE-2016-1237?
Linux kernel versions up to 4.6.3 are affected by CVE-2016-1237.
How can local users exploit CVE-2016-1237?
Local users can exploit CVE-2016-1237 by setting a POSIX ACL to bypass file-permission restrictions.
Where can I find more information about CVE-2016-1237?
You can find more information about CVE-2016-1237 on the Openwall mailing list, the Linux kernel commit, and the Red Hat Bugzilla page.