oss-security February 2011 archive
Main Archive Page > Month Archives  > oss-security archives
oss-security: [oss-security] CVE request: kernel: CAP_SYS_MODULE

[oss-security] CVE request: kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN

From: Kees Cook <kees_at_nospam>
Date: Thu Feb 24 2011 - 23:54:30 GMT
To: oss-security@lists.openwall.com

Hi,

While not as bad as CVE-2010-4661 (unprivileged module loading)
I'd like to get a CVE assigned for this issue for tracking purposes:
https://lkml.org/lkml/2011/2/24/203

Basically "ifconfig $module" will load any module as long as the process
has CAP_NET_ADMIN (ignoring CAP_SYS_MODULE).

-Kees

-- Kees Cook Ubuntu Security Team