Vulnerability Description
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 3.16 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Fedoraproject | Fedora | 34 |
| Redhat | Mrg Realtime | 2.0 |
| Redhat | Virtualization | 4.0 |
| Redhat | Enterprise Linux Aus | 7.4 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Eus | 7.4 |
| Redhat | Enterprise Linux For Real Time | 7 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Aus | 6.6 |
| Redhat | Enterprise Linux Server Tus | 7.2 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| F5 | Big-Ip Access Policy Manager | >= 13.0.0, < 13.1.3.5 |
| F5 | Big-Ip Advanced Firewall Manager | >= 13.0.0, < 13.1.3.5 |
| F5 | Big-Ip Analytics | >= 13.0.0, < 13.1.3.5 |
| F5 | Big-Ip Application Acceleration Manager | >= 13.0.0, < 13.1.3.5 |
| F5 | Big-Ip Application Security Manager | >= 13.0.0, < 13.1.3.5 |
| F5 | Big-Ip Domain Name System | >= 13.0.0, < 13.1.3.5 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecPatchVendor Advisory
- http://openwall.com/lists/oss-security/2018/07/13/2Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/106503Broken Link
- https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3083Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3096Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0717Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2566Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2696Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2730Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4164Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840Mailing ListPatchVendor Advisory
- https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46cPatchThird Party Advisory
FAQ
What is CVE-2018-13405?
CVE-2018-13405 is a vulnerability with a CVSS score of 7.8 (HIGH). The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain...
How severe is CVE-2018-13405?
CVE-2018-13405 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-13405?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux, Canonical Ubuntu Linux, Fedoraproject Fedora, Redhat Mrg Realtime.