[CVE-2008-2931] Local privilege escalation in Linux (do_change_type() in fs/namespace.c)

[Till Ulen]

Binary package hint: linux-source-2.6.20

CVE-2008-2931 description:

"The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2931

Dapper and Feisty might be affected.

[Till Ulen (tillulen)]

Changed affected package from linux-source-2.6.20 to linux as per <https://wiki.ubuntu.com/Bugs/FindRightPackage#Kernel related bugs>.

[Leann Ogasawara (leannogasawara)]

Thanks Alexander,

The security team has backported patches for this. They are currently pending and awaiting arrival into the archive. Also, you had correctly opened this against the 2.6.20 kernel source. It's only for bugs against 2.6.24 or later that they will target the "linux" package. Thanks.

[Till Ulen (tillulen)]

On Mon, Aug 11, 2008 at 21:38, Leann Ogasawara <leann at ubuntu> wrote:
>
> [...] Also, you had correctly
> opened this against the 2.6.20 kernel source. It's only for bugs
> against 2.6.24 or later that they will target the "linux" package.

If so, please update the wiki page at
<https://wiki.ubuntu.com/Bugs/FindRightPackage#Kernel related bugs>.
It currently suggests that the bugs in Feisty and Gutsy kernels
(2.6.20 and 2.6.22) should be reported against the "linux" package.

Thanks for the clarification.

[Leann Ogasawara (leannogasawara)]

Looks like this was fixed for both Dapper and Feisty a while ago:

http://www.ubuntu.com/usn/usn-637-1