Description
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.openwall.com/lists/oss-security/2010/01/20/2 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=537177 ↗
- http://support.avaya.com/css/P8/documents/100073666 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9738 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55809 ↗
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6744 ↗
- https://rhn.redhat.com/errata/RHSA-2010-0095.html ↗
- https://rhn.redhat.com/errata/RHSA-2010-0046.html ↗