CVE-2014-8989

Published: 29 November 2014

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.

From the Ubuntu Security Team

A flaw was discovered in how supplemental group memberships are handled in certain namespace scenarios. A local user could exploit this flaw to bypass file permission restrictions.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

for precise/3.2 kernel, prio is low, due to lack of support
for unprivileged user namespaces

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8989
• http://thread.gmane.org/gmane.linux.man/7385/
• https://ubuntu.com/security/notices/USN-2515-1
• https://ubuntu.com/security/notices/USN-2516-1
• https://ubuntu.com/security/notices/USN-2517-1
• https://ubuntu.com/security/notices/USN-2518-1
• http://www.openwall.com/lists/oss-security/2014/11/20/4
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1395189