NetSight
IP …
high7.8Public exploit code

CVE-2018-13405

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
through 3.16
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04
FedoraprojectFedora
Versions 34, 35
RedhatMrg Realtime
Version 2.0
RedhatVirtualization
Version 4.0
RedhatEnterprise Linux Aus
Version 7.4
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 7.4, 7.5
RedhatEnterprise Linux For Real Time
Version 7
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.6, 7.2, 7.3

Weakness classification

CWE-269

References