CVE-2018-13405

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

• linux linux kernel (<= 3.16) • debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • fedoraproject fedora 34 • fedoraproject fedora 35 • redhat mrg realtime 2.0 • redhat virtualization 4.0 • redhat enterprise linux aus 7.4 • redhat enterprise linux desktop 6.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.4 • redhat enterprise linux eus 7.5 • redhat enterprise linux for real time 7 • redhat enterprise linux server 6.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 6.6 • redhat enterprise linux server aus 7.2 • redhat enterprise linux server aus 7.3 • redhat enterprise linux server tus 7.2 • redhat enterprise linux server tus 7.3 • redhat enterprise linux server tus 7.4 • redhat enterprise linux workstation 6.0 • redhat enterprise linux workstation 7.0 • f5 big-ip access policy manager (>= 13.0.0 < 13.1.3.5) • f5 big-ip access policy manager (>= 14.0.0 < 14.1.3.1) • f5 big-ip access policy manager (>= 15.0.0 < 15.0.1.4) • f5 big-ip access policy manager 15.1.0 • f5 big-ip access policy manager 16.0.0 • f5 big-ip advanced firewall manager (>= 13.0.0 < 13.1.3.5) • f5 big-ip advanced firewall manager (>= 14.0.0 < 14.1.3.1) • f5 big-ip advanced firewall manager (>= 15.0.0 < 15.0.1.4) • f5 big-ip advanced firewall manager 15.1.0 • f5 big-ip advanced firewall manager 16.0.0 • f5 big-ip analytics (>= 13.0.0 < 13.1.3.5) • f5 big-ip analytics (>= 14.0.0 < 14.1.3.1) • f5 big-ip analytics (>= 15.0.0 < 15.0.1.4) • f5 big-ip analytics 15.1.0 • f5 big-ip analytics 16.0.0 • f5 big-ip application acceleration manager (>= 13.0.0 < 13.1.3.5) • f5 big-ip application acceleration manager (>= 14.0.0 < 14.1.3.1) • f5 big-ip application acceleration manager (>= 15.0.0 < 15.0.1.4) • f5 big-ip application acceleration manager 15.1.0 • f5 big-ip application acceleration manager 16.0.0 • f5 big-ip application security manager (>= 13.0.0 < 13.1.3.5) • f5 big-ip application security manager (>= 14.0.0 < 14.1.3.1) • f5 big-ip application security manager (>= 15.0.0 < 15.0.1.4) • f5 big-ip application security manager 15.1.0 • f5 big-ip application security manager 16.0.0 • f5 big-ip domain name system (>= 13.0.0 < 13.1.3.5) • f5 big-ip domain name system (>= 14.0.0 < 14.1.3.1) • f5 big-ip domain name system (>= 15.0.0 < 15.0.1.4) • f5 big-ip domain name system 15.1.0 • f5 big-ip domain name system 16.0.0 • f5 big-ip edge gateway (>= 13.0.0 < 13.1.3.5) • f5 big-ip edge gateway (>= 14.0.0 < 14.1.3.1) • f5 big-ip edge gateway (>= 15.0.0 < 15.0.1.4) • f5 big-ip edge gateway 15.1.0 … and 31 more