CVE-2014-5207

Published: 13 August 2014

fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a "mount -o remount" command within a user namespace.

From the Ubuntu Security Team

Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels

this fix was assigned to CVE-2014-5206: db181ce011e3c033328608299cd6fac06ea50130

linux-lts-saucy no longer receives official support

Status

References

• http://www.openwall.com/lists/oss-security/2014/08/13/4
• http://www.openwall.com/lists/oss-security/2014/08/12/6
• https://ubuntu.com/security/notices/USN-2317-1
• https://ubuntu.com/security/notices/USN-2318-1
• https://www.cve.org/CVERecord?id=CVE-2014-5207
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1356323