UBUNTU-CVE-2018-13405
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
02 / AFFECTED SOFTWARE
Affected packages
136 explicit affected versions
17 explicit affected versions
57 explicit affected versions
79 explicit affected versions
38 explicit affected versions
20 explicit affected versions
18 explicit affected versions
38 explicit affected versions
17 explicit affected versions
51 explicit affected versions
49 explicit affected versions
16 explicit affected versions
11 explicit affected versions
11 explicit affected versions
10 explicit affected versions
11 explicit affected versions
8 explicit affected versions
12 explicit affected versions
26 explicit affected versions
51 explicit affected versions
6 explicit affected versions
12 explicit affected versions
1 explicit affected versions
1 explicit affected versions
23 explicit affected versions
1 explicit affected versions
3 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linux/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7
- https://twitter.com/grsecurity/status/1015082951204327425
- https://ubuntu.com/security/CVE-2018-13405
- https://ubuntu.com/security/notices/USN-3752-1
- https://ubuntu.com/security/notices/USN-3752-2
- https://ubuntu.com/security/notices/USN-3752-3
- https://ubuntu.com/security/notices/USN-3753-1
- https://ubuntu.com/security/notices/USN-3753-2
- https://ubuntu.com/security/notices/USN-3754-1
- https://www.cve.org/CVERecord?id=CVE-2018-13405
- https://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/