PT-2008-5180 · Linux+1 · Linux Kernel+1

CVE-2008-3833

·

Publicado

2008-10-03

·

Atualizado

2023-02-13

CVSS v2.0

4.9

Média

VetorAV:L/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.19
Description The issue allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory. This is achieved through the generic file splice write function in fs/splice.c, which does not properly strip setuid and setgid bits when there is a write to a file.
Recommendations For Linux kernel versions prior to 2.6.19, update to version 2.6.19 or later to resolve the issue.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-3833
DSA-1653-1
RHSA-2008:0957
RHSA-2008_0957

Produtos afetados

Linux Kernel
Red Hat