The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.

The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.

Kernel: fs: VFS denial of service Kernel: fs: umount denial of service kernel: ext4 filesystem page fault race condition with fallocate call. kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: Overflowing kernel mount table using shared bind mount kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c kernel: Use after free in SCSI generic device interface Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user kernel: Memory leaks in xfs_attr_list.c error paths kernel: netlink: double-free in netlink_dump kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel: Kernel crash by spawning mcrypt(alg) with incompatible algorithm kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c Kernel: kvm: use after free in complete_emulated_mmio Kernel: kvm: page reference leakage in handle_vmon kernel: Null pointer dereference in search_keyring kernel: ping socket / AF_LLC connect() sin_family race kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) kernel: ipv4: Invalid IP options could cause skb->dst drop kernel…

Kernel: fs: VFS denial of service Kernel: fs: umount denial of service kernel: ext4 filesystem page fault race condition with fallocate call. kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: Overflowing kernel mount table using shared bind mount kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c kernel: Use after free in SCSI generic device interface Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user kernel: Memory leaks in xfs_attr_list.c error paths kernel: netlink: double-free in netlink_dump kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel: Kernel crash by spawning mcrypt(alg) with incompatible algorithm kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c Kernel: kvm: use after free in complete_emulated_mmio Kernel: kvm: page reference leakage in handle_vmon kernel: Null pointer dereference in search_keyring kernel: ping socket / AF_LLC connect() sin_family race kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) kernel: ipv4: Invalid IP options could cause skb->dst drop kernel…

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-hwe, Ubuntu:18.04:LTS: linux-hwe-edge, Ubuntu:20.04:LTS: linux-azure-fde, Ubuntu:Pro:20.04:LTS: linux-azure-fde-5.15, Ubuntu:20.04:LTS: linux-gke, Ubuntu:20.04:LTS: linux-gkeop, Ubuntu:20.04:LTS: linux-raspi2 and 11 more

The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.