Re: [OE-core][PATCH v3 3/9] cve-exclusions: set status for CVE-2021-3864

[Paul Barker <paul@pbarker.dev>]

On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote:
> begin_new_exec() resets dumpability to owner-dumpable whenever the real
> and effective ids match at exec time. A binary exec'd by a setuid
> program that has already called setuid(0) therefore becomes dumpable as
> root, and with a relative core_pattern plus an attacker-controlled
> working directory the resulting core file can be dropped into a
> privileged directory such as /etc/logrotate.d.
> 
> Full report with proof of concept:
> 
>   https://www.openwall.com/lists/oss-security/2021/10/20/2
> 
> Two fixes were proposed and neither was merged. Waiman Long's patch was
> judged an ineffective mitigation by Eric W. Biederman and the discussion
> went quiet in early 2022; Wander Lairson Costa's RFC v2 received design
> feedback and no v3 followed:
> 
>   https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/
>   https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/
> 
> The flagged logic is unchanged: fs/exec.c still selects
> TASK_DUMPABLE_OWNER in that case, and fs/coredump.c only applies the
> suid-safe restriction when dumpable is TASK_DUMPABLE_ROOT, so the
> dumpable==1 case this CVE describes is not covered. Images that set an
> absolute path, a pipe or a socket core_pattern are not exploitable.

This third paragraph is unnecessary detail.

> 
> CC: Paul Barker <paul@pbarker.dev>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
> ---
> v3:
> - use "unpatched" instead of "upstream-wontfix"; a NAK of one
>   mitigation is not an upstream wontfix of the issue
> - drop the "NAKed" wording: the discussion went quiet, it was not
>   formally rejected
> 
> v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/
> 
>  meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
> index af3576d..ba8e467 100644
> --- a/meta/recipes-kernel/linux/cve-exclusion.inc
> +++ b/meta/recipes-kernel/linux/cve-exclusion.inc
> @@ -206,3 +206,11 @@ host model, no upstream kernel fix, mitigated by firewall configuration"
>  # https://security-tracker.debian.org/tracker/CVE-2021-3714
>  CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \
>  KSM page deduplication, only reachable when KSM is enabled and opted into"
> +
> +# Two mitigation attempts, neither merged; the fs/exec.c logic is
> +# unchanged. An absolute, piped or socket kernel.core_pattern (for
> +# example systemd-coredump) prevents exploitation.
> +# https://www.openwall.com/lists/oss-security/2021/10/20/2
> +# https://ubuntu.com/security/CVE-2021-3864
> +CVE_STATUS[CVE-2021-3864] = "unpatched: no accepted mainline fix, \
> +exploitation requires a relative kernel.core_pattern"

Suggested wording, links, and include triage date:

    # Triaged August 2026 - Two fixes proposed upstream but neither was merged,
    # attempts to fix seem to have petered out. Unfixed in Debian/Ubuntu.
    # https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/
    # https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/
    # https://security-tracker.debian.org/tracker/CVE-2021-3864
    # https://ubuntu.com/security/CVE-2021-3864
    CVE_STATUS[CVE-2021-3864] = "unpatched: Proposed fixes were not merged upstream"

Best regards,

-- 
Paul Barker