CVE-2014-9710

Published: 31 December 2014

The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.

From the Ubuntu Security Team

Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9710
• http://www.openwall.com/lists/oss-security/2015/03/24/11
• https://ubuntu.com/security/notices/USN-2615-1
• https://ubuntu.com/security/notices/USN-2616-1
• https://ubuntu.com/security/notices/USN-2662-1
• https://ubuntu.com/security/notices/USN-2663-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1438501