CVE-2013-1858

Publication date 5 April 2013

Last updated 24 July 2024

The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
linux	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not affected
linux-armadaxp	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
linux-ec2	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
linux-fsl-imx51	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Ignored end of life
	8.04 LTS hardy	Not in release
linux-linaro-omap	12.10 quantal	Ignored end of life
	12.04 LTS precise	Ignored end of life
	11.10 oneiric	Ignored end of life
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
linux-linaro-shared	12.10 quantal	Ignored end of life
	12.04 LTS precise	Ignored end of life
	11.10 oneiric	Ignored end of life
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
linux-linaro-vexpress	12.10 quantal	Ignored end of life
	12.04 LTS precise	Ignored end of life
	11.10 oneiric	Ignored end of life
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
linux-lts-backport-maverick	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Ignored end of life
	8.04 LTS hardy	Not in release
linux-lts-backport-oneiric	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
linux-lts-quantal	12.10 quantal	Not in release
	12.04 LTS precise	Not affected
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
linux-mvl-dove	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Ignored end of life
	8.04 LTS hardy	Not in release
linux-qcm-msm	12.10 quantal	Ignored end of life
	12.04 LTS precise	Ignored end of life
	11.10 oneiric	Ignored end of life
	10.04 LTS lucid	Ignored end of life
	8.04 LTS hardy	Not in release
linux-ti-omap4	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

Notes

mdeslaur

reproducer: http://stealth.openwall.net/xSports/clown-newuser.c

jdstrand

this became privilege esclation when 5eaf563e53294d6696e651466697eb9d491f3946 removed the checks for CAP_SYS_ADMIN, CAP_SETUID and CAP_SETGID

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by 5eaf563, fixed by e66eded