The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-PAEUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-xen-develUpgrade kernel-docUpgrade kernel-xenUpgrade kernelUpgrade kernel-PAE-devel | Dec 1, 2016 | Oct 3, 2008 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Oct 3, 2008 |
| Suse | — | Upgrade kernel-sourceUpgrade suse-releaseUpgrade kernel-ppc64Upgrade kernel-symsUpgrade kernel-iseries64Upgrade kernel-xenUpgrade kernel-xenpaeUpgrade kernel-defaultUpgrade kernel-kdumpUpgrade kernel-bigsmp | Feb 17, 2015 | Oct 3, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub