⌘ + K

UBUNTU-CVE-2017-5551

Dashboard / Vulnerabilities / UBUNTU-CVE-2017-5551

UBUNTU-CVE-2017-5551

Published: 6 Feb 2017Last Modified: 22 Apr 2026

Upstream:

Aliases:

Summary:

Details: The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.

References: https://ubuntu.com/security/CVE-2017-5551, http://seclists.org/oss-sec/2017/q1/161, https://ubuntu.com/security/notices/USN-3234-2, https://ubuntu.com/security/notices/USN-3234-1, https://ubuntu.com/security/notices/USN-3359-1, https://ubuntu.com/security/notices/USN-3361-1, https://www.cve.org/CVERecord?id=CVE-2017-5551

Affected packages

Package

Name: linux-lts-xenial

Purl: pkg:deb/ubuntu/[email protected]~14.04.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -4.4.0-67.88~14.04.1

Affected versions

4.4.0-13.29~14.04.1

4.4.0-14.30~14.04.2

4.4.0-15.31~14.04.1

4.4.0-18.34~14.04.1

4.4.0-21.37~14.04.1

4.4.0-22.39~14.04.1

4.4.0-22.40~14.04.1

4.4.0-24.43~14.04.1

4.4.0-28.47~14.04.1

4.4.0-31.50~14.04.1

4.4.0-34.53~14.04.1

4.4.0-36.55~14.04.1

4.4.0-38.57~14.04.1

4.4.0-42.62~14.04.1

4.4.0-45.66~14.04.1

4.4.0-47.68~14.04.1

4.4.0-51.72~14.04.1

4.4.0-53.74~14.04.1

4.4.0-57.78~14.04.1

4.4.0-59.80~14.04.1

4.4.0-62.83~14.04.1

4.4.0-63.84~14.04.2

4.4.0-64.85~14.04.1

4.4.0-66.87~14.04.1

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High