CVE-2018-13405

    Dashboard / Vulnerabilities / CVE-2018-13405

    CVE-2018-13405

    Published: 6 Jul 2018Last Modified: 16 Apr 2026

    Summary:

    Details: The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRBNBX73SAFKQWBOX76SLMWPTKJPVGEJ/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKKIAUMR5FAYLZ7HLEPOXMKAAE3BYBQ/, http://www.securityfocus.com/bid/106503, https://access.redhat.com/errata/RHSA-2018:3096, https://access.redhat.com/errata/RHSA-2019:4164, https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html, https://support.f5.com/csp/article/K00854051, https://usn.ubuntu.com/3753-2/, https://www.debian.org/security/2018/dsa-4266, https://access.redhat.com/errata/RHSA-2019:2730, https://usn.ubuntu.com/3752-2/, https://usn.ubuntu.com/3752-3/, https://usn.ubuntu.com/3754-1/, https://access.redhat.com/errata/RHSA-2018:2948, https://access.redhat.com/errata/RHSA-2019:2566, https://access.redhat.com/errata/RHSA-2019:2696, https://twitter.com/grsecurity/status/1015082951204327425, https://usn.ubuntu.com/3752-1/, https://access.redhat.com/errata/RHSA-2018:3083, https://access.redhat.com/errata/RHSA-2019:0717, https://access.redhat.com/errata/RHSA-2019:2476, https://access.redhat.com/errata/RHSA-2019:4159, https://usn.ubuntu.com/3753-1/, http://openwall.com/lists/oss-security/2018/07/13/2, http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7, https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7, https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840cd61c23e2b9241093737b4c395cb406, https://www.exploit-db.com/exploits/45033/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High