CVE-2009-1630
- State
- Published
- Severity
- Not scored
- Published
- May 14, 2009
- Updated
- Aug 7, 2024
- Reserved
- May 14, 2009
Description
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- MDVSA-2009:135vendor-advisory
- DSA-1865vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0111
- [linux-nfs] 20090509 [NFS] [PATCH] nfs: Fix NFS v4 client handling of MAY_EXEC in nfs_permission.mailing-list
- 34934vdb-entry
- 37471third-party-advisory
- [nfsv4] 20061116 Status of execute permissions in NFSv4 ACLs ?mailing-list
- [oss-security] 20090513 CVE request: kernel: problem with NFS v4 client handling of MAY_EXEC in nfs_permissionmailing-list
- MDVSA-2009:148vendor-advisory
- 35656third-party-advisory
- oval:org.mitre.oval:def:9990vdb-entrysignature
- DSA-1844vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- ADV-2009-1331vdb-entry
- RHSA-2009:1157vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=500297
- 35106third-party-advisory
- 20090724 rPSA-2009-0111-1 kernelmailing-list
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party componentsmailing-list
- 36051third-party-advisory
- 35298third-party-advisory
- 36327third-party-advisory
- oval:org.mitre.oval:def:8543vdb-entrysignature
- SUSE-SA:2009:031vendor-advisory
- http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
- USN-793-1vendor-advisory
- [nfsv4] 20061117 [Patch] Re: Status of execute permissions in NFSv4 ACLs ?mailing-list
- SUSE-SA:2009:038vendor-advisory
- ADV-2009-3316vdb-entry
- 35394third-party-advisory
- DSA-1809vendor-advisory
- 35847third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.