CVE-2010-2071

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba
http://lkml.org/lkml/2010/5/17/544Exploit, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/06/11/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/06/14/2Mailing List, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba
http://lkml.org/lkml/2010/5/17/544Exploit, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/06/11/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/06/14/2Mailing List, Third Party Advisory

Timeline

Published: Jun 16, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-20723.6Pyftpd 0.8.4 creates log files with predictable names in a temporary directory, which allows local users to cause a denial of service and ob CVE-2010-20737.5auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allo CVE-2010-20746.8istream.c in w3m 0.5.2 and possibly other versions, when ssl_verify_server is enabled, does not properly handle a '\0' character in a domain CVE-2010-20757.5UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modificat CVE-2010-20769.8Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, A CVE-2010-20785.0DataTrack System 3.5 allows remote attackers to list the root directory via a (1) /%u0085/ or (2) /%u00A0/ URI.CVE-2010-20795.0DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing ba CVE-2010-20803.5Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow rem CVE-2010-20825.0The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 has a default administrative CVE-2010-20834.0Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote authenticated users to by CVE-2010-20844.3Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows rem CVE-2010-20854.3The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows rem