PT-2008-5180 · Linux+1 · Linux Kernel+1

Published

2008-10-03

·

Updated

2023-02-13

·

CVE-2008-3833

CVSS v2.0

4.9

Medium

VectorAV:L/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.19
Description The issue allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory. This is achieved through the generic file splice write function in fs/splice.c, which does not properly strip setuid and setgid bits when there is a write to a file.
Recommendations For Linux kernel versions prior to 2.6.19, update to version 2.6.19 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3833
DSA-1653-1
RHSA-2008:0957
RHSA-2008_0957

Affected Products

Linux Kernel
Red Hat