CVE-2008-4210: Medium severity linux kernel vulnerability
Description of problem: When creating a file, open()/creat() allows the setgid bit to be set via the mode argument even when, due to the bsdgroups mount option or the file being created in a setgid directory, the new file's group is one which the user is not a member of. The user can then use ftruncate() and memory-mapped I/O to turn the new file into an arbitrary binary and thus gain the privileges of this group, since these operations do not clear the setgid bit.
Other sources
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-4210?
CVE-2008-4210 is classified as a medium severity vulnerability due to its potential to allow unauthorized file permissions.
How do I fix CVE-2008-4210?
To fix CVE-2008-4210, update the kernel to a version that includes the patch addressing this vulnerability.
Which systems are affected by CVE-2008-4210?
CVE-2008-4210 affects various Linux kernel versions, including 2.6.18 through 2.6.21.7 and several other specific versions.
Can CVE-2008-4210 be exploited remotely?
CVE-2008-4210 primarily requires local access to the system for exploitation, making it less of a remote threat.
What are the potential consequences of CVE-2008-4210?
Exploitation of CVE-2008-4210 could lead to unauthorized access to files by manipulating setgid permissions.