Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
BID:46323
Info
Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
| Bugtraq ID: | 46323 |
| Class: | Design Error |
| CVE: |
CVE-2011-0006 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 10 2011 12:00AM |
| Updated: | Apr 13 2015 10:06PM |
| Credit: | Mimi Zohar |
| Vulnerable: |
Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 SuSE SUSE Linux Enterprise Server 11 SP1 SuSE SUSE Linux Enterprise High Availability Extension 11 SP1 SuSE Suse Linux Enterprise Desktop 11 SP1 Linux kernel 2.6.32 .9 Linux kernel 2.6.32 Linux kernel 2.6.31 5 Linux kernel 2.6.31 13 Linux kernel 2.6.31 .2 Linux kernel 2.6.31 .11 Linux kernel 2.6.31 -rc7 Linux kernel 2.6.31 -rc6 Linux kernel 2.6.31 -rc3 Linux kernel 2.6.31 -rc1 Linux kernel 2.6.31 Linux kernel 2.6.30 .10 Linux kernel 2.6.30 .1 Linux kernel 2.6.30 -rc6 Linux kernel 2.6.30 -rc5 Linux kernel 2.6.30 -rc3 Linux kernel 2.6.30 -rc2 Linux kernel 2.6.30 -rc1 Linux kernel 2.6.30 Linux kernel 2.6.32.8 Linux kernel 2.6.32.7 Linux kernel 2.6.32.6 Linux kernel 2.6.32.5 Linux kernel 2.6.32.4 Linux kernel 2.6.32.3 Linux kernel 2.6.32.22 Linux kernel 2.6.32.2 Linux kernel 2.6.32.18 Linux kernel 2.6.32.17 Linux kernel 2.6.32.16 Linux kernel 2.6.32.15 Linux kernel 2.6.32.14 Linux kernel 2.6.32.13 Linux kernel 2.6.32.12 Linux kernel 2.6.32.11 Linux kernel 2.6.32.10 Linux kernel 2.6.32.1 Linux kernel 2.6.32-rc8 Linux kernel 2.6.32-rc7 Linux kernel 2.6.32-rc5 Linux kernel 2.6.32-rc4 Linux kernel 2.6.32-rc3 Linux kernel 2.6.32-rc2 Linux kernel 2.6.32-rc1 Linux kernel 2.6.31.6 Linux kernel 2.6.31.4 Linux kernel 2.6.31.1 Linux kernel 2.6.31-rc9 Linux kernel 2.6.31-rc8 Linux kernel 2.6.31-rc5-git3 Linux kernel 2.6.31-rc4 Linux kernel 2.6.31-rc2 Linux kernel 2.6.31-git11 Linux kernel 2.6.30.5 Linux kernel 2.6.30.4 Linux kernel 2.6.30.3 |
| Not Vulnerable: |
Linux kernel 2.6.32.28 |
Discussion
Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
The Linux kernel is prone to a local security-bypass vulnerability because the return value for the 'security_filter_rule_init()' function can permit some Linux Security Modules (LSM) to be ignored.
Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions.
This issue was introduced in Linux kernel 2.6.30-rc1 and resolved in Linux kernel 2.6.32.28.
The Linux kernel is prone to a local security-bypass vulnerability because the return value for the 'security_filter_rule_init()' function can permit some Linux Security Modules (LSM) to be ignored.
Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions.
This issue was introduced in Linux kernel 2.6.30-rc1 and resolved in Linux kernel 2.6.32.28.
Exploit / POC
Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
The 'tcb selinux=0' boot parameter along with 'dont_measure obj_type=var_log_t' rule in the default IMA TCB measurement policy is sufficient to trigger the issue:
The 'tcb selinux=0' boot parameter along with 'dont_measure obj_type=var_log_t' rule in the default IMA TCB measurement policy is sufficient to trigger the issue:
Solution / Fix
Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Linux Kernel 'security_filter_rule_init()' Local Security Bypass Vulnerability
References:
References:
- Bug 667912 - (CVE-2011-0006) CVE-2011-0006 kernel: ima: fix add LSM rule bug (Eugene Teo)
- ima: fix add LSM rule bug (Mimi Zohar)
- Linux kernel Homepage (kernel.org)