Lucene search
HistoryNov 30, 2014 - 1:59 a.m.
CVE-2014-8989
linux kernel
bypass file permissions
negative groups issue
cve-2014-8989
nvd
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
5.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a “negative groups” issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Affected configurations
Node
linuxlinux_kernelRange≤3.17.3
ORlinuxlinux_kernelMatch3.0rc1
ORlinuxlinux_kernelMatch3.0rc2
ORlinuxlinux_kernelMatch3.0rc3
ORlinuxlinux_kernelMatch3.0rc4
ORlinuxlinux_kernelMatch3.0rc5
ORlinuxlinux_kernelMatch3.0rc6
ORlinuxlinux_kernelMatch3.0rc7
ORlinuxlinux_kernelMatch3.0.1
ORlinuxlinux_kernelMatch3.0.2
ORlinuxlinux_kernelMatch3.0.3
ORlinuxlinux_kernelMatch3.0.4
ORlinuxlinux_kernelMatch3.0.5
ORlinuxlinux_kernelMatch3.0.6
ORlinuxlinux_kernelMatch3.0.7
ORlinuxlinux_kernelMatch3.0.8
ORlinuxlinux_kernelMatch3.0.9
ORlinuxlinux_kernelMatch3.0.10
ORlinuxlinux_kernelMatch3.0.11
ORlinuxlinux_kernelMatch3.0.12
ORlinuxlinux_kernelMatch3.0.13
ORlinuxlinux_kernelMatch3.0.14
ORlinuxlinux_kernelMatch3.0.15
ORlinuxlinux_kernelMatch3.0.16
ORlinuxlinux_kernelMatch3.0.17
ORlinuxlinux_kernelMatch3.0.18
ORlinuxlinux_kernelMatch3.0.19
ORlinuxlinux_kernelMatch3.0.20
ORlinuxlinux_kernelMatch3.0.21
ORlinuxlinux_kernelMatch3.0.22
ORlinuxlinux_kernelMatch3.0.23
ORlinuxlinux_kernelMatch3.0.24
ORlinuxlinux_kernelMatch3.0.25
ORlinuxlinux_kernelMatch3.0.26
ORlinuxlinux_kernelMatch3.0.27
ORlinuxlinux_kernelMatch3.0.28
ORlinuxlinux_kernelMatch3.0.29
ORlinuxlinux_kernelMatch3.0.30
ORlinuxlinux_kernelMatch3.0.31
ORlinuxlinux_kernelMatch3.0.32
ORlinuxlinux_kernelMatch3.0.33
ORlinuxlinux_kernelMatch3.0.34
ORlinuxlinux_kernelMatch3.0.35
ORlinuxlinux_kernelMatch3.0.36
ORlinuxlinux_kernelMatch3.0.37
ORlinuxlinux_kernelMatch3.0.38
ORlinuxlinux_kernelMatch3.0.39
ORlinuxlinux_kernelMatch3.0.40
ORlinuxlinux_kernelMatch3.0.41
ORlinuxlinux_kernelMatch3.0.42
ORlinuxlinux_kernelMatch3.0.43
ORlinuxlinux_kernelMatch3.0.44
ORlinuxlinux_kernelMatch3.0.45
ORlinuxlinux_kernelMatch3.0.46
ORlinuxlinux_kernelMatch3.0.47
ORlinuxlinux_kernelMatch3.0.48
ORlinuxlinux_kernelMatch3.0.49
ORlinuxlinux_kernelMatch3.0.50
ORlinuxlinux_kernelMatch3.0.51
ORlinuxlinux_kernelMatch3.0.52
ORlinuxlinux_kernelMatch3.0.53
ORlinuxlinux_kernelMatch3.0.54
ORlinuxlinux_kernelMatch3.0.55
ORlinuxlinux_kernelMatch3.0.56
ORlinuxlinux_kernelMatch3.0.57
ORlinuxlinux_kernelMatch3.0.58
ORlinuxlinux_kernelMatch3.0.59
ORlinuxlinux_kernelMatch3.0.60
ORlinuxlinux_kernelMatch3.0.61
ORlinuxlinux_kernelMatch3.0.62
ORlinuxlinux_kernelMatch3.0.63
ORlinuxlinux_kernelMatch3.0.64
ORlinuxlinux_kernelMatch3.0.65
ORlinuxlinux_kernelMatch3.0.66
ORlinuxlinux_kernelMatch3.0.67
ORlinuxlinux_kernelMatch3.0.68
ORlinuxlinux_kernelMatch3.1
ORlinuxlinux_kernelMatch3.1rc1
ORlinuxlinux_kernelMatch3.1rc2
ORlinuxlinux_kernelMatch3.1rc3
ORlinuxlinux_kernelMatch3.1rc4
ORlinuxlinux_kernelMatch3.1.1
ORlinuxlinux_kernelMatch3.1.2
ORlinuxlinux_kernelMatch3.1.3
ORlinuxlinux_kernelMatch3.1.4
ORlinuxlinux_kernelMatch3.1.5
ORlinuxlinux_kernelMatch3.1.6
ORlinuxlinux_kernelMatch3.1.7
ORlinuxlinux_kernelMatch3.1.8
ORlinuxlinux_kernelMatch3.1.9
ORlinuxlinux_kernelMatch3.1.10
ORlinuxlinux_kernelMatch3.2
ORlinuxlinux_kernelMatch3.2x86
ORlinuxlinux_kernelMatch3.2rc2
ORlinuxlinux_kernelMatch3.2rc3
ORlinuxlinux_kernelMatch3.10
ORlinuxlinux_kernelMatch3.10.0arm64
ORlinuxlinux_kernelMatch3.10.1
ORlinuxlinux_kernelMatch3.10.1arm64
ORlinuxlinux_kernelMatch3.10.2
ORlinuxlinux_kernelMatch3.10.2arm64
ORlinuxlinux_kernelMatch3.10.3
ORlinuxlinux_kernelMatch3.10.3arm64
ORlinuxlinux_kernelMatch3.10.4
ORlinuxlinux_kernelMatch3.10.4arm64
ORlinuxlinux_kernelMatch3.10.5
ORlinuxlinux_kernelMatch3.10.5arm64
ORlinuxlinux_kernelMatch3.10.6
ORlinuxlinux_kernelMatch3.10.6arm64
ORlinuxlinux_kernelMatch3.10.7
ORlinuxlinux_kernelMatch3.10.7arm64
ORlinuxlinux_kernelMatch3.10.8
ORlinuxlinux_kernelMatch3.10.8arm64
ORlinuxlinux_kernelMatch3.10.9
ORlinuxlinux_kernelMatch3.10.9arm64
ORlinuxlinux_kernelMatch3.10.10
ORlinuxlinux_kernelMatch3.10.11
ORlinuxlinux_kernelMatch3.10.12
ORlinuxlinux_kernelMatch3.10.13
ORlinuxlinux_kernelMatch3.10.14
ORlinuxlinux_kernelMatch3.10.15
ORlinuxlinux_kernelMatch3.10.16
ORlinuxlinux_kernelMatch3.10.17
ORlinuxlinux_kernelMatch3.10.18
ORlinuxlinux_kernelMatch3.10.19
ORlinuxlinux_kernelMatch3.10.20
ORlinuxlinux_kernelMatch3.10.21
ORlinuxlinux_kernelMatch3.10.22
ORlinuxlinux_kernelMatch3.10.23
ORlinuxlinux_kernelMatch3.10.24
ORlinuxlinux_kernelMatch3.10.25
ORlinuxlinux_kernelMatch3.10.26
ORlinuxlinux_kernelMatch3.10.27
ORlinuxlinux_kernelMatch3.10.28
ORlinuxlinux_kernelMatch3.10.29
ORlinuxlinux_kernelMatch3.11
ORlinuxlinux_kernelMatch3.11.1
ORlinuxlinux_kernelMatch3.11.2
ORlinuxlinux_kernelMatch3.11.3
ORlinuxlinux_kernelMatch3.11.4
ORlinuxlinux_kernelMatch3.11.5
ORlinuxlinux_kernelMatch3.11.6
ORlinuxlinux_kernelMatch3.11.7
ORlinuxlinux_kernelMatch3.11.8
ORlinuxlinux_kernelMatch3.11.9
ORlinuxlinux_kernelMatch3.11.10
ORlinuxlinux_kernelMatch3.12
ORlinuxlinux_kernelMatch3.12.1
ORlinuxlinux_kernelMatch3.12.2
ORlinuxlinux_kernelMatch3.12.3
ORlinuxlinux_kernelMatch3.12.4
ORlinuxlinux_kernelMatch3.12.5
ORlinuxlinux_kernelMatch3.12.6
ORlinuxlinux_kernelMatch3.12.7
ORlinuxlinux_kernelMatch3.12.8
ORlinuxlinux_kernelMatch3.12.9
ORlinuxlinux_kernelMatch3.12.10
ORlinuxlinux_kernelMatch3.12.11
ORlinuxlinux_kernelMatch3.12.12
ORlinuxlinux_kernelMatch3.12.13
ORlinuxlinux_kernelMatch3.12.14
ORlinuxlinux_kernelMatch3.12.15
ORlinuxlinux_kernelMatch3.12.16
ORlinuxlinux_kernelMatch3.12.17
ORlinuxlinux_kernelMatch3.13
ORlinuxlinux_kernelMatch3.13.1
ORlinuxlinux_kernelMatch3.13.2
ORlinuxlinux_kernelMatch3.13.3
ORlinuxlinux_kernelMatch3.13.4
ORlinuxlinux_kernelMatch3.13.5
ORlinuxlinux_kernelMatch3.13.6
ORlinuxlinux_kernelMatch3.13.7
ORlinuxlinux_kernelMatch3.13.8
ORlinuxlinux_kernelMatch3.13.9
ORlinuxlinux_kernelMatch3.13.10
ORlinuxlinux_kernelMatch3.13.11
ORlinuxlinux_kernelMatch3.14-
ORlinuxlinux_kernelMatch3.14rc1
ORlinuxlinux_kernelMatch3.14rc2
ORlinuxlinux_kernelMatch3.14rc3
ORlinuxlinux_kernelMatch3.14rc4
ORlinuxlinux_kernelMatch3.14rc5
ORlinuxlinux_kernelMatch3.14rc6
ORlinuxlinux_kernelMatch3.14rc7
ORlinuxlinux_kernelMatch3.14rc8
ORlinuxlinux_kernelMatch3.14.1
ORlinuxlinux_kernelMatch3.14.2
ORlinuxlinux_kernelMatch3.14.3
ORlinuxlinux_kernelMatch3.14.4
ORlinuxlinux_kernelMatch3.14.5
ORlinuxlinux_kernelMatch3.15
ORlinuxlinux_kernelMatch3.15.1
ORlinuxlinux_kernelMatch3.15.2
ORlinuxlinux_kernelMatch3.15.3
ORlinuxlinux_kernelMatch3.15.4
ORlinuxlinux_kernelMatch3.15.5
ORlinuxlinux_kernelMatch3.15.6
ORlinuxlinux_kernelMatch3.15.7
ORlinuxlinux_kernelMatch3.15.8
ORlinuxlinux_kernelMatch3.16.0
ORlinuxlinux_kernelMatch3.16.1
ORlinuxlinux_kernelMatch3.17
ORlinuxlinux_kernelMatch3.17.1
ORlinuxlinux_kernelMatch3.17.2
References
lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html
lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html
thread.gmane.org/gmane.linux.man/7385/
www.mandriva.com/security/advisories?name=MDVSA-2015:058
www.openwall.com/lists/oss-security/2014/11/20/4
www.securityfocus.com/bid/71154
www.ubuntu.com/usn/USN-2515-1
www.ubuntu.com/usn/USN-2516-1
www.ubuntu.com/usn/USN-2517-1
www.ubuntu.com/usn/USN-2518-1
Related
prion
prion
Code injection
2014-11-30 01:59:00
nvd
nvd
CVE-2014-8989
2014-11-30 01:59:07
ubuntucve
ubuntucve
CVE-2014-8989
2014-11-29 00:00:00
debiancve
debiancve
CVE-2014-8989
2014-11-30 01:59:07
cvelist
cvelist
CVE-2014-8989
2014-11-30 01:00:00
amazon
amazon
Medium: kernel
2015-02-11 19:34:00
nessus
nessus
Amazon Linux AMI : kernel (ALAS-2015-476)
2015-02-13 00:00:00
Fedora 20 : kernel-3.17.8-200.fc20 (2015-0515)
2015-01-13 00:00:00
Fedora 21 : kernel-3.17.8-300.fc21 (2015-0517)
2015-01-12 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2015-476)
2015-09-08 00:00:00
Oracle: Security Advisory (ELSA-2015-3064)
2015-10-06 00:00:00
Mageia: Security Advisory (MGASA-2015-0070)
2022-01-28 00:00:00
oraclelinux
oraclelinux
Unbreakable Enterprise kernel security , bug fix and enhancement update
2015-07-30 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: kernel-3.17.8-300.fc21
2015-01-11 02:58:06
[SECURITY] Fedora 21 Update: kernel-3.18.3-201.fc21
2015-01-26 02:31:22
[SECURITY] Fedora 21 Update: kernel-3.18.5-201.fc21
2015-02-06 04:00:35
mageia
mageia
Updated kernel packages fix security vulnerabilities
2015-02-17 21:38:13
Updated kernel-linus packages fix security vulnerabilities
2015-02-19 17:43:07
Updated kernel-vserver packages fix security vulnerabilities
2015-02-19 17:43:07
ubuntu
ubuntu
Linux kernel vulnerabilities
2015-02-26 00:00:00
Linux kernel vulnerability regression
2015-02-28 00:00:00
Linux kernel vulnerabilities regression
2015-03-04 00:00:00
suse
suse
Security update for the Linux Kernel (important)
2016-02-03 15:11:57
Security update for the Linux Kernel (important)
2016-02-01 16:11:19
securityvulns
securityvulns
lenovo
lenovo
AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US
2020-04-13 19:22:04
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
5.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%
Related for CVE-2014-8989