CVE-2016-7097: Medium severity Linux Linux kernel vulnerability
A vulnerability was found in the Linux kernel. When file permissions are modified via chmod and the user is not in the owning group or capable of CAPFSETID, the setgid bit is cleared in inodechangeok(). Setting a POSIX ACL via setxattr sets the filepermissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod.
Suggested upstream patch:
http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2
http://www.spinics.net/lists/linux-fsdevel/msg101138.html
Upstream commits:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31
Previous suggestions:
http://www.spinics.net/lists/linux-fsdevel/msg98328.html
https://patchwork.kernel.org/patch/9137067/
https://patchwork.kernel.org/patch/9138935/
CVE request+assignment:
http://seclists.org/oss-sec/2016/q3/380
http://seclists.org/oss-sec/2016/q3/382
Other sources
The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-132.181 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-51.72~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-51.72 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.4.0-1038.45 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.4.0-1042.46
Event History
Frequently Asked Questions
What is CVE-2016-7097?
CVE-2016-7097 is a vulnerability in the Linux kernel that allows local users to gain group privileges.
How does CVE-2016-7097 work?
CVE-2016-7097 works by preserving the setgid bit during a setxattr call, which can be leveraged by local users to gain group privileges.
What is the severity of CVE-2016-7097?
CVE-2016-7097 has a severity rating of medium.
Which software versions are affected by CVE-2016-7097?
The software versions affected by CVE-2016-7097 include Linux kernel versions through 4.8.2.
How can I fix CVE-2016-7097?
To fix CVE-2016-7097, update your Linux kernel to a version that is higher than 4.8.2.