CVE-2010-2071

The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.

• CWE-264

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba
• http://lkml.org/lkml/2010/5/17/544Exploit, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/06/11/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/06/14/2Mailing List, Third Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba
• http://lkml.org/lkml/2010/5/17/544Exploit, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/06/11/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/06/14/2Mailing List, Third Party Advisory

Published

Jun 16, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2065Integer overflow in the TIFFroundup macro in LibTIFF before …
• CVE-2010-2066The mext_check_arguments function in fs/ext4/move_extent.c i…5.5
• CVE-2010-2067Stack-based buffer overflow in the TIFFFetchSubjectDistance …
• CVE-2010-2068mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server…
• CVE-2010-2069Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2010-2070arch/ia64/xen/faults.c in Xen 3.4 and 4.0 in Linux kernel 2.…
• CVE-2010-2072Pyftpd 0.8.4 creates log files with predictable names in a t…
• CVE-2010-2073auth_db_config.py in Pyftpd 0.8.4 contains hard-coded userna…7.5
• CVE-2010-2074istream.c in w3m 0.5.2 and possibly other versions, when ssl…
• CVE-2010-2075UnrealIRCd 3.2.8.1, as distributed on certain mirror sites f…
• CVE-2010-2076Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2…9.8
• CVE-2010-2077Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…