Design/Logic Flaw

2018-07-0614:29:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

CPENameOperatorVersion
ubuntu_linuxeq16.04
ubuntu_linuxeq14.04
ubuntu_linuxeq18.04
ubuntu_linuxeq16.04
debian_linuxeq8.0
debian_linuxeq9.0
big-ip_access_policy_managereq15.1.0
big-ip_access_policy_managerge15.0.0
big-ip_access_policy_managerlt15.0.1.4
big-ip_access_policy_managereq16.0.0

Name	Operator	Version
ubuntu_linux	eq	16.04
ubuntu_linux	eq	14.04
ubuntu_linux	eq	18.04
ubuntu_linux	eq	16.04
debian_linux	eq	8.0
debian_linux	eq	9.0
big-ip_access_policy_manager	eq	15.1.0
big-ip_access_policy_manager	ge	15.0.0
big-ip_access_policy_manager	lt	15.0.1.4
big-ip_access_policy_manager	eq	16.0.0