The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-debug-develUpgrade kernel-xenUpgrade kernel-PAEUpgrade kernel-headersUpgrade kernel-docUpgrade kernel-xen-develUpgrade kernel-PAE-develUpgrade kernel-debugUpgrade kernelUpgrade kernel-devel | Dec 1, 2016 | Oct 3, 2008 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Oct 3, 2008 |
| Suse | — | Upgrade kernel-xenUpgrade kernel-iseries64Upgrade kernel-sourceUpgrade suse-releaseUpgrade kernel-ppc64Upgrade kernel-symsUpgrade kernel-xenpaeUpgrade kernel-bigsmpUpgrade kernel-defaultUpgrade kernel-kdump | Feb 17, 2015 | Oct 3, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub