ecryptfs team mailing list archive

Thread
Date
[Bug 732628] Re: TOCTOU in mount.ecryptfs_private

To: ecryptfs@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <732628@xxxxxxxxxxxxxxxxxx>
Date: Thu, 29 Sep 2011 08:27:22 -0000
Reply-to: Bug 732628 <732628@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
This bug was fixed in the package linux-lts-backport-maverick -
2.6.35-30.60~lucid1

---------------
linux-lts-backport-maverick (2.6.35-30.60~lucid1) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #854430

  [ Stefan Bader ]

  * [Config] Force perf to use libiberty for demangling
    - LP: #783660

  [ Tim Gardner ]

  * [Config] Simplify binary-udebs dependencies
  * [Config] kernel preparation cannot be parallelized
  * [Config] Linearize module/abi checks
  * [Config] Linearize and simplify tree preparation rules
  * [Config] Build kernel image in parallel with modules
  * [Config] Set concurrency for kmake invocations
  * [Config] Improve install-arch-headers speed
  * [Config] Fix binary-perarch dependencies
  * [Config] Removed stamp-flavours target
  * [Config] Serialize binary indep targets
  * [Config] Use build stamp directly
  * [Config] Restore prepare-% target
  * [Config] Fix binary-% build target

  [ Upstream Kernel Changes ]

  * Add mount option to check uid of device being mounted = expect uid,
    CVE-2011-1833
    - LP: #732628
    - CVE-2011-1833
  * ipv6: make fragment identifications less predictable, CVE-2011-2699
    - LP: #827685
    - CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
    - LP: #834121
    - CVE-2011-2918
  * cifs: fix possible memory corruption in CIFSFindNext, CVE-2011-3191
    - LP: #834135
    - CVE-2011-3191
  * befs: Validate length of long symbolic links, CVE-2011-2928
    - LP: #834124
    - CVE-2011-2928
  * gro: Only reset frag0 when skb can be pulled, CVE-2011-2723
    - LP: #844371
    - CVE-2011-2723
  * Validate size of EFI GUID partition entries, CVE-2011-1776
    - LP: #844365
    - CVE-2011-1776
  * inet_diag: fix inet_diag_bc_audit(), CVE-2011-2213
    - LP: #838421
    - CVE-2011-2213
  * si4713-i2c: avoid potential buffer overflow on si4713, CVE-2011-2700
    - LP: #844370
    - CVE-2011-2700
  * Bluetooth: Prevent buffer overflow in l2cap config request,
    CVE-2011-2497
    - LP: #838423
    - CVE-2011-2497
  * core: Fix memory leak/corruption on VLAN GRO_DROP, CVE-2011-1576
    - LP: #844361
    - CVE-2011-1576

linux (2.6.35-30.59) maverick-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #837449

  [ Upstream Kernel Changes ]

  * Revert "drm/nv50-nvc0: work around an evo channel hang that some people
    see"
  * Revert "eCryptfs: Handle failed metadata read in lookup"
 -- Herton Ronaldo Krzesinski <herton.krzesinski@xxxxxxxxxxxxx>   Tue, 20 Sep 2011 11:03:51 -0300

** Changed in: linux-lts-backport-maverick (Ubuntu Lucid)
       Status: Fix Committed => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1576

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1776

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-2213

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-2497

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-2700

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-2723

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-2928

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-3191

** Changed in: linux-lts-backport-natty (Ubuntu Lucid)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of eCryptfs,
which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/732628

Title:
  TOCTOU in mount.ecryptfs_private

Status in eCryptfs - Enterprise Cryptographic Filesystem:
  Fix Released
Status in “ecryptfs-utils” package in Ubuntu:
  Fix Released
Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux-ec2” package in Ubuntu:
  Invalid
Status in “linux-fsl-imx51” package in Ubuntu:
  Invalid
Status in “linux-linaro” package in Ubuntu:
  New
Status in “linux-lts-backport-maverick” package in Ubuntu:
  Invalid
Status in “linux-lts-backport-natty” package in Ubuntu:
  Invalid
Status in “linux-mvl-dove” package in Ubuntu:
  Invalid
Status in “linux-qcm-msm” package in Ubuntu:
  Invalid
Status in “linux-source-2.6.15” package in Ubuntu:
  Invalid
Status in “linux-ti-omap” package in Ubuntu:
  Invalid
Status in “linux-ti-omap4” package in Ubuntu:
  Fix Committed
Status in “ecryptfs-utils” source package in Lucid:
  Fix Released
Status in “linux” source package in Lucid:
  Fix Committed
Status in “linux-ec2” source package in Lucid:
  Fix Committed
Status in “linux-fsl-imx51” source package in Lucid:
  Fix Released
Status in “linux-linaro” source package in Lucid:
  New
Status in “linux-lts-backport-maverick” source package in Lucid:
  Fix Released
Status in “linux-lts-backport-natty” source package in Lucid:
  Fix Released
Status in “linux-mvl-dove” source package in Lucid:
  Fix Committed
Status in “linux-qcm-msm” source package in Lucid:
  Invalid
Status in “linux-source-2.6.15” source package in Lucid:
  Invalid
Status in “linux-ti-omap” source package in Lucid:
  Invalid
Status in “linux-ti-omap4” source package in Lucid:
  Invalid
Status in “ecryptfs-utils” source package in Maverick:
  Fix Released
Status in “linux” source package in Maverick:
  Fix Committed
Status in “linux-ec2” source package in Maverick:
  Invalid
Status in “linux-fsl-imx51” source package in Maverick:
  Invalid
Status in “linux-linaro” source package in Maverick:
  New
Status in “linux-lts-backport-maverick” source package in Maverick:
  Invalid
Status in “linux-lts-backport-natty” source package in Maverick:
  Invalid
Status in “linux-mvl-dove” source package in Maverick:
  Fix Committed
Status in “linux-qcm-msm” source package in Maverick:
  Invalid
Status in “linux-source-2.6.15” source package in Maverick:
  Invalid
Status in “linux-ti-omap” source package in Maverick:
  Invalid
Status in “linux-ti-omap4” source package in Maverick:
  Fix Released
Status in “ecryptfs-utils” source package in Natty:
  Fix Released
Status in “linux” source package in Natty:
  Fix Released
Status in “linux-ec2” source package in Natty:
  Invalid
Status in “linux-fsl-imx51” source package in Natty:
  Invalid
Status in “linux-linaro” source package in Natty:
  New
Status in “linux-lts-backport-maverick” source package in Natty:
  Invalid
Status in “linux-lts-backport-natty” source package in Natty:
  Invalid
Status in “linux-mvl-dove” source package in Natty:
  Invalid
Status in “linux-qcm-msm” source package in Natty:
  Invalid
Status in “linux-source-2.6.15” source package in Natty:
  Invalid
Status in “linux-ti-omap” source package in Natty:
  Invalid
Status in “linux-ti-omap4” source package in Natty:
  Fix Released
Status in “ecryptfs-utils” source package in Oneiric:
  Fix Released
Status in “linux” source package in Oneiric:
  Fix Released
Status in “linux-ec2” source package in Oneiric:
  Invalid
Status in “linux-fsl-imx51” source package in Oneiric:
  Invalid
Status in “linux-linaro” source package in Oneiric:
  New
Status in “linux-lts-backport-maverick” source package in Oneiric:
  Invalid
Status in “linux-lts-backport-natty” source package in Oneiric:
  Invalid
Status in “linux-mvl-dove” source package in Oneiric:
  Invalid
Status in “linux-qcm-msm” source package in Oneiric:
  Invalid
Status in “linux-source-2.6.15” source package in Oneiric:
  Invalid
Status in “linux-ti-omap” source package in Oneiric:
  Invalid
Status in “linux-ti-omap4” source package in Oneiric:
  Fix Committed
Status in “ecryptfs-utils” source package in Hardy:
  Invalid
Status in “linux” source package in Hardy:
  Invalid
Status in “linux-ec2” source package in Hardy:
  Invalid
Status in “linux-fsl-imx51” source package in Hardy:
  Invalid
Status in “linux-linaro” source package in Hardy:
  New
Status in “linux-lts-backport-maverick” source package in Hardy:
  Invalid
Status in “linux-lts-backport-natty” source package in Hardy:
  Invalid
Status in “linux-mvl-dove” source package in Hardy:
  Invalid
Status in “linux-qcm-msm” source package in Hardy:
  Invalid
Status in “linux-source-2.6.15” source package in Hardy:
  Invalid
Status in “linux-ti-omap” source package in Hardy:
  Invalid
Status in “linux-ti-omap4” source package in Hardy:
  Invalid
Status in “ecryptfs-utils” package in Debian:
  Fix Released
Status in Fedora:
  Fix Released

Bug description:
  check_ownerships() function doesn't work as it should because of a
  race condition. Arguments of both mount() and umount() calls can be
  changed between the check and the usage. This may lead to arbitrary
  mount point umounting or probably to gaining ability to try
  passphrases of otherpeople's ecryptfs storages. lock_counter() is also
  racy. It (1) tries to check existance and ownership of the file before
  open(), (2) neither use stat() instead of lstat() nor O_NOFOLLOW, (3)
  is not protected against deletion of the lock file by the owner. The
  lock file should be probably created in root only writable directory
  before dropping EUID.

  Break-Fix: 237fead619984cc48818fe12ee0ceada3f55b012
  764355487ea220fdc2faf128d577d7f679b91f97

To manage notifications about this bug go to:
https://bugs.launchpad.net/ecryptfs/+bug/732628/+subscriptions
References

[Bug 732628] [NEW] TOCTOU in mount.ecryptfs_private
From: segooon, 2011-03-10