Re: user controllable usermodehelper in br_stp_if.c

2015-11-30 Thread Richard Weinberger
Am 30.11.2015 um 21:14 schrieb Kees Cook: > On Sun, Nov 29, 2015 at 2:43 PM, Richard Weinberger wrote: >> Hi! >> >> By spawning new network and user namesapces an unprivileged user >> is able to execute /sbin/bridge-stp within the initial mount namespace >> with global root rights. >> While this c

Re: user controllable usermodehelper in br_stp_if.c

2015-11-30 Thread Kees Cook
On Sun, Nov 29, 2015 at 2:43 PM, Richard Weinberger wrote: > Hi! > > By spawning new network and user namesapces an unprivileged user > is able to execute /sbin/bridge-stp within the initial mount namespace > with global root rights. > While this cannot directly be used to break out of a container

user controllable usermodehelper in br_stp_if.c

2015-11-29 Thread Richard Weinberger
Hi! By spawning new network and user namesapces an unprivileged user is able to execute /sbin/bridge-stp within the initial mount namespace with global root rights. While this cannot directly be used to break out of a container or gain global root rights it could be used by exploit writers as valu