[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2010-2071Date: (C)2010-06-16   (M)2024-02-22


The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.6
Exploit Score: 3.9
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
http://lkml.org/lkml/2010/5/17/544
http://www.openwall.com/lists/oss-security/2010/06/11/3
http://www.openwall.com/lists/oss-security/2010/06/14/2
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba

CWE    1
CWE-264
OVAL    17
oval:org.secpod.oval:def:100728
oval:org.secpod.oval:def:102716
oval:org.secpod.oval:def:100642
oval:org.secpod.oval:def:101036
...

© SecPod Technologies