In the Linux kernel, the following vulnerability has been resolved:
selinux,smack: don't bypass permissions check in inode_setsecctx hook
Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled.
The end of the kerneldoc comment for _vfssetxattr_noperm() states:
nfsdsetattr() does do permissions checking via fhverify() and nfsdpermission(), but those don't do all the same permissions checks that are done by securityinode_setxattr() and its related LSM hooks do.
Since nfsdsetattr() is the only consumer of securityinodesetsecctx(), simplest solution appears to be to replace the call to _vfssetxattrnoperm() with a call to _vfssetxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label.
[
{
"id": "CVE-2024-46695-0c4f2cdd",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"87942706808856504957690324748229001023",
"41351376584910535251610138165850187925",
"219461673660680380840165307742982736028",
"315275328043553675661918594123110021006",
"174055974276121647840097907772460899680"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eebec98791d0137e455cc006411bb92a54250924",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-29830ba9",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"260116958249631452108713474379303122556",
"78360485021067708791338250964471589841",
"159185696084194566973228396611328685639",
"150742545538029687615185715956155250182",
"29207569078248733180313409151375706318"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a0e79bc84f466999fa501fce5bf7a07641b8a7",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-45e07143",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"160589016251671809687669174341882333030",
"146426635972876690832370245174809616707",
"103162212688474743389667197772957451404",
"102053822721646691565537853772365584367"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-48ec9329",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "247063879081955534163188451223445960804",
"length": 158.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@459584258d47ec3cc6245a82e8a49c9d08eb8b57",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-53a195b2",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "200961695053939346640127335560614822518",
"length": 159.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eebec98791d0137e455cc006411bb92a54250924",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-57e85a3c",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "186580541355216905611522121552822470727",
"length": 140.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-59ceaff3",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"260116958249631452108713474379303122556",
"78360485021067708791338250964471589841",
"159185696084194566973228396611328685639",
"150742545538029687615185715956155250182",
"29207569078248733180313409151375706318"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f71ec019257ba4f7ab198bd948c5902a207bad96",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-604d5963",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "215058921998701970951004628436027562608",
"length": 160.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f71ec019257ba4f7ab198bd948c5902a207bad96",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-613d565d",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "105099504643765470161317228677533906343",
"length": 142.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-637ec088",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "321390858848395756691124540013591834057",
"length": 157.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eebec98791d0137e455cc006411bb92a54250924",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-6e30e4e0",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "321390858848395756691124540013591834057",
"length": 157.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0cd53791119f6287b6532af8ce41576d664930",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-73b4978e",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"260116958249631452108713474379303122556",
"78360485021067708791338250964471589841",
"159185696084194566973228396611328685639",
"150742545538029687615185715956155250182",
"29207569078248733180313409151375706318"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@459584258d47ec3cc6245a82e8a49c9d08eb8b57",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-8371f1ee",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"158662699346765378906681739350700851088",
"122932499909387040795415650532353785671",
"329903723659053808786269685209471344591",
"140059726246574749143743364504404699438",
"174055974276121647840097907772460899680"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@459584258d47ec3cc6245a82e8a49c9d08eb8b57",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-8e0da37f",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "215058921998701970951004628436027562608",
"length": 160.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a0e79bc84f466999fa501fce5bf7a07641b8a7",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-a201fca8",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "200961695053939346640127335560614822518",
"length": 159.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0cd53791119f6287b6532af8ce41576d664930",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-aa54b271",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"158662699346765378906681739350700851088",
"122932499909387040795415650532353785671",
"329903723659053808786269685209471344591",
"140059726246574749143743364504404699438",
"174055974276121647840097907772460899680"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a0e79bc84f466999fa501fce5bf7a07641b8a7",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-aca7a230",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"205836656339036221431565279463904830204",
"253329031479338277169193022846999196477",
"208588956583886668130138296266709997510",
"137844514495525441743398014587710777563",
"29207569078248733180313409151375706318"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0cd53791119f6287b6532af8ce41576d664930",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-af845e32",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"205836656339036221431565279463904830204",
"253329031479338277169193022846999196477",
"208588956583886668130138296266709997510",
"137844514495525441743398014587710777563",
"29207569078248733180313409151375706318"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eebec98791d0137e455cc006411bb92a54250924",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-bb1faaca",
"target": {
"file": "security/smack/smack_lsm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165128923061971593747187596169897729267",
"111483175801756040205132120142131001483",
"197771605750317053052019644960883117817",
"292530676293231416705664398589638816728"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-cf0f0a86",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"87942706808856504957690324748229001023",
"41351376584910535251610138165850187925",
"219461673660680380840165307742982736028",
"315275328043553675661918594123110021006",
"174055974276121647840097907772460899680"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0cd53791119f6287b6532af8ce41576d664930",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-d55a903b",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "247063879081955534163188451223445960804",
"length": 158.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a0e79bc84f466999fa501fce5bf7a07641b8a7",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-e162d24b",
"target": {
"file": "security/smack/smack_lsm.c",
"function": "smack_inode_setsecctx"
},
"digest": {
"function_hash": "247063879081955534163188451223445960804",
"length": 158.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f71ec019257ba4f7ab198bd948c5902a207bad96",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-e46bec22",
"target": {
"file": "security/selinux/hooks.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"158662699346765378906681739350700851088",
"122932499909387040795415650532353785671",
"329903723659053808786269685209471344591",
"140059726246574749143743364504404699438",
"174055974276121647840097907772460899680"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f71ec019257ba4f7ab198bd948c5902a207bad96",
"signature_version": "v1"
},
{
"id": "CVE-2024-46695-e492e624",
"target": {
"file": "security/selinux/hooks.c",
"function": "selinux_inode_setsecctx"
},
"digest": {
"function_hash": "215058921998701970951004628436027562608",
"length": 160.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@459584258d47ec3cc6245a82e8a49c9d08eb8b57",
"signature_version": "v1"
}
]