fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-headersUpgrade kernel-PAEUpgrade kernel-PAE-develUpgrade kernel-debug-develUpgrade kernel-hugememUpgrade kernel-xenUUpgrade kernel-hugemem-develUpgrade kernelUpgrade kernel-xenU-develUpgrade kernel-smp-develUpgrade kernel-docUpgrade kernel-smpUpgrade kernel-xenUpgrade kernel-debugUpgrade kernel-xen-develUpgrade kernel-devel | Dec 1, 2016 | Sep 29, 2008 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Sep 29, 2008 |
| Suse | — | Upgrade kernel-iseries64Upgrade kernel-xenUpgrade kernel-bigsmpUpgrade kernel-pseries64Upgrade um-host-kernelUpgrade kernel-sourceUpgrade kernel-s390xUpgrade kernel-64k-pagesizeUpgrade kernel-debugUpgrade suse-releaseUpgrade kernel-pmac64Upgrade kernel-s390-debugUpgrade kernel-umUpgrade kernel-s390x-debugUpgrade kernel-symsUpgrade kernel-sn2Upgrade kernel-smpUpgrade um-host-install-initrdUpgrade kernel-s390Upgrade kernel-kdumpUpgrade kernel-defaultUpgrade kernel-ppc64Upgrade kernel-xenpae | Feb 17, 2015 | Sep 29, 2008 |
| Ubuntu | — | Upgrade linux-image-2.6.22-16-hppa64Upgrade linux-image-2.6.27-9-virtualUpgrade linux-image-2.6.24-22-virtualUpgrade linux-image-2.6.24-22-serverUpgrade linux-image-2.6.22-16-powerpcUpgrade linux-image-2.6.27-9-serverUpgrade linux-image-2.6.15-53-server-bigironUpgrade linux-image-2.6.22-16-lpiaUpgrade linux-image-2.6.22-16-sparc64Upgrade linux-image-2.6.22-16-mckinleyUpgrade linux-image-2.6.22-16-serverUpgrade linux-image-2.6.24-22-powerpcUpgrade linux-image-2.6.24-22-hppa64Upgrade linux-image-2.6.22-16-powerpc64-smpUpgrade linux-image-2.6.24-22-powerpc-smpUpgrade linux-image-2.6.22-16-386Upgrade linux-image-2.6.24-22-hppa32Upgrade linux-image-2.6.15-53-hppa32Upgrade linux-image-2.6.15-53-mckinleyUpgrade linux-image-2.6.15-53-powerpcUpgrade linux-image-2.6.24-22-sparc64Upgrade linux-image-2.6.22-16-itaniumUpgrade linux-image-2.6.15-53-sparc64-smpUpgrade linux-image-2.6.24-22-powerpc64-smpUpgrade linux-image-2.6.24-22-xenUpgrade linux-image-2.6.22-16-rtUpgrade linux-image-2.6.24-22-lpiaUpgrade linux-image-2.6.24-22-itaniumUpgrade linux-image-2.6.15-53-powerpc-smpUpgrade linux-image-2.6.15-53-itaniumUpgrade linux-image-2.6.22-16-xenUpgrade linux-image-2.6.24-22-openvzUpgrade linux-image-2.6.22-16-sparc64-smpUpgrade linux-image-2.6.27-9-genericUpgrade linux-image-2.6.22-16-hppa32Upgrade linux-image-2.6.15-53-powerpc64-smpUpgrade linux-image-2.6.24-22-rtUpgrade linux-image-2.6.15-53-amd64-k8Upgrade linux-image-2.6.15-53-hppa64-smpUpgrade linux-image-2.6.24-22-sparc64-smpUpgrade linux-image-2.6.15-53-sparc64Upgrade linux-image-2.6.15-53-amd64-serverUpgrade linux-image-2.6.22-16-virtualUpgrade linux-image-2.6.15-53-686Upgrade linux-image-2.6.15-53-amd64-xeonUpgrade linux-image-2.6.15-53-hppa64Upgrade linux-image-2.6.22-16-lpiacompatUpgrade linux-image-2.6.15-53-hppa32-smpUpgrade linux-image-2.6.24-22-mckinleyUpgrade linux-image-2.6.24-22-386Upgrade linux-image-2.6.15-53-itanium-smpUpgrade linux-image-2.6.22-16-umeUpgrade linux-image-2.6.15-53-serverUpgrade linux-image-2.6.24-22-genericUpgrade linux-image-2.6.22-16-cellUpgrade linux-image-2.6.15-53-mckinley-smpUpgrade linux-image-2.6.15-53-amd64-genericUpgrade linux-image-2.6.24-22-lpiacompatUpgrade linux-image-2.6.15-53-k7Upgrade linux-image-2.6.22-16-powerpc-smpUpgrade linux-image-2.6.15-53-386Upgrade linux-image-2.6.22-16-generic | Nov 8, 2024 | Sep 29, 2008 |
| Vmsa 2009 0014 | — | Upgrade VMware ESX 3.5 to build number 199239 | Nov 19, 2010 | Sep 29, 2008 |
| Vmsa 2009 0015 | — | Apply ESX350-200910401-SG. | Feb 16, 2011 | Sep 29, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub