Executive Summary

This vulnerability exists in the Linux kernel's SELinux security model for overlayfs filesystems. The model is designed to allow access if the current task can access the top-level file (the "user" file) and the mounter's credentials allow access to the lower-level file (the "backing" file). However, the existing code did not properly enforce these access controls for mmap() and mprotect() operations on overlayfs filesystems.

The issue was that mmap() and mprotect() operations could bypass the intended SELinux access checks on the backing file, potentially allowing unauthorized access. The fix involved using a new security_mmap_backing_file() LSM hook to enforce access checks for mmap() operations and leveraging a new backing file API and LSM blob to enforce mprotect() access controls properly.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow processes to bypass SELinux access controls on overlayfs filesystems during mmap() and mprotect() operations. As a result, unauthorized access to files could occur, potentially leading to information disclosure or unauthorized modification of data.

Useful 0 Not Useful 0