CVE-2015-3339: Race Condition
A race condition flaw was found between the chown() and execve() system calls. When changing the owner of a setuid-user binary to root, the race condition could momentarily make the binary setuid root. When root chown()ed an attacker-owned setuid file to root, the file briefly was setuid root (and executable as such).
An attacker could take advantage of this small window and execute a setuid binary with elevated privileges.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
Additional details:
http://seclists.org/oss-sec/2015/q2/216
Other sources
Race condition in the preparebinprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3339?
CVE-2015-3339 has a medium severity rating due to the potential for privilege escalation.
How do I fix CVE-2015-3339?
To fix CVE-2015-3339, ensure you update to the patched versions of the Linux kernel or Debian packages that address this vulnerability.
What systems are affected by CVE-2015-3339?
CVE-2015-3339 affects multiple versions of the Linux kernel up to 3.19.5 and both Debian 7.0 and 8.0 distributions.
How does CVE-2015-3339 work?
CVE-2015-3339 exploits a race condition between the chown() and execve() system calls, allowing unauthorized users to gain root privileges.
Is there a known exploit for CVE-2015-3339?
Yes, there are known exploits for CVE-2015-3339 that can allow an attacker to exploit privilege escalation opportunities in affected systems.