CVE-2014-9710
Description
From CVE.org
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
Statement
This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.
This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.
Given the Moderate impact and the fact that BRTFS file system is no longer Technology preview in Red Hat Enterprise Linux 6 this issue is not currently planned to be addressed in future releases of Red Hat Enterprise Linux 6.
Acknowledgements
This issue was discovered by Alexandre Oliva (Red Hat Inc).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
