In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
9p: fix access mode flags being ORed instead of replaced<\/p>\n
Since commit 1f3e4142c0eb (“9p: convert to the new mount API”),
\nv9fs_apply_options() applies parsed mount flags with |= onto flags
\nalready set by v9fs_session_init(). For 9P2000.L, session_init sets
\nV9FS_ACCESS_CLIENT as the default, so when the user mounts with
\n“access=user”, both bits end up set. Access mode checks compare
\nagainst exact values, so having both bits set matches neither mode.<\/p>\n
This causes v9fs_fid_lookup() to fall through to the default switch
\ncase, using INVALID_UID (nobody\/65534) instead of current_fsuid()
\nfor all fid lookups. Root is then unable to chown or perform other
\nprivileged operations.<\/p>\n
Fix by clearing the access mask before applying the user’s choice.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
9p: fix access mode flags being ORed instead of replaced<\/p>\n
Since commit 1f3e4142c0eb (“9p: convert to the new mount API”),
\nv9fs_appl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16136","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}