The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
07 Nov 2023, 02:52
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
06 Apr 2022, 15:28
Type | Values Removed | Values Added |
---|---|---|
First Time |
Redhat enterprise Linux Server
Redhat enterprise Linux Eus Redhat enterprise Linux Server Aus F5 big-ip Edge Gateway Redhat virtualization F5 F5 big-ip Advanced Firewall Manager F5 big-ip Local Traffic Manager Redhat enterprise Linux Workstation F5 big-ip Webaccelerator F5 big-ip Policy Enforcement Manager Redhat F5 big-ip Link Controller Redhat enterprise Linux Desktop Redhat enterprise Linux Aus Redhat enterprise Linux Server Tus Fedoraproject fedora F5 big-ip Fraud Protection Service F5 big-ip Domain Name System F5 big-ip Analytics F5 big-ip Application Security Manager Redhat mrg Realtime F5 big-ip Access Policy Manager F5 big-ip Application Acceleration Manager F5 big-ip Global Traffic Manager Redhat enterprise Linux For Real Time Fedoraproject |
|
References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:3083 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2566 - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTKKIAUMR5FAYLZ7HLEPOXMKAAE3BYBQ/ - Mailing List, Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2476 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:0717 - Third Party Advisory | |
References | (BID) http://www.securityfocus.com/bid/106503 - Broken Link | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:4159 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:4164 - Third Party Advisory | |
References | (UBUNTU) https://usn.ubuntu.com/3752-3/ - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2730 - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HRBNBX73SAFKQWBOX76SLMWPTKJPVGEJ/ - Mailing List, Third Party Advisory | |
References | (CONFIRM) https://support.f5.com/csp/article/K00854051 - Third Party Advisory | |
References | (CONFIRM) https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840cd61c23e2b9241093737b4c395cb406 - Mailing List, Patch, Vendor Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2696 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:2948 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:3096 - Third Party Advisory | |
CPE | cpe:2.3:a:f5:big-ip_analytics:15.1.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_local_traffic_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_acceleration_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_security_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_link_controller:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_edge_gateway:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_global_traffic_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_access_policy_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_edge_gateway:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:mrg_realtime:2.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* cpe:2.3:a:f5:big-ip_local_traffic_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_fraud_protection_service:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_policy_enforcement_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_webaccelerator:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_webaccelerator:16.0.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_fraud_protection_service:15.1.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_analytics:16.0.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_acceleration_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_advanced_firewall_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_policy_enforcement_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time:7:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_security_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_advanced_firewall_manager:16.0.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_aus:7.4:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_global_traffic_manager:15.1.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_link_controller:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_domain_name_system:16.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_domain_name_system:15.1.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* |
25 Feb 2022, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
15 Feb 2022, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
05 Jan 2021, 20:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. |
Information
Published : 2018-07-06 14:29
Updated : 2023-12-10 12:30
NVD link : CVE-2018-13405
Mitre link : CVE-2018-13405
CVE.ORG link : CVE-2018-13405
JSON object : View
Products Affected
debian
- debian_linux
f5
- big-ip_application_security_manager
- big-ip_link_controller
- big-ip_local_traffic_manager
- big-ip_analytics
- big-ip_application_acceleration_manager
- big-ip_global_traffic_manager
- big-ip_domain_name_system
- big-ip_webaccelerator
- big-ip_edge_gateway
- big-ip_access_policy_manager
- big-ip_policy_enforcement_manager
- big-ip_advanced_firewall_manager
- big-ip_fraud_protection_service
redhat
- enterprise_linux_server_aus
- enterprise_linux_server_tus
- enterprise_linux_eus
- virtualization
- enterprise_linux_workstation
- enterprise_linux_server
- enterprise_linux_desktop
- enterprise_linux_aus
- enterprise_linux_for_real_time
- mrg_realtime
linux
- linux_kernel
fedoraproject
- fedora
canonical
- ubuntu_linux
CWE
CWE-269
Improper Privilege Management