CVE-2009-3286

Published: 22 September 2009

NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.

Priority

Medium

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
Upstream
Released (2.6.19~rc6)
Patches:
Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed by 81ac95c5569d7a60ab5db6c1ccec56c12b3ebcb5
linux-source-2.6.15
Launchpad, Ubuntu, Debian
Upstream
Released (2.6.19~rc6)