CVE-2018-13405

Published: 6 July 2018

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

From the Ubuntu Security Team

It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a non-member of the group. A local attacker could use this to gain elevated privileges.

Notes

While inode_init_owner() has only been vulnerable since its
introduction in a1bd120d13e586ea1c424048fd2c8420a442852a, this flaw has been
present in individual filesystems since the beginning of the kernel git
history.

Status

Severity score breakdown

References

• https://git.kernel.org/linux/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7
• https://twitter.com/grsecurity/status/1015082951204327425
• https://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/
• https://ubuntu.com/security/notices/USN-3752-1
• https://ubuntu.com/security/notices/USN-3752-2
• https://ubuntu.com/security/notices/USN-3753-1
• https://ubuntu.com/security/notices/USN-3753-2
• https://ubuntu.com/security/notices/USN-3754-1
• https://ubuntu.com/security/notices/USN-3752-3
• https://www.cve.org/CVERecord?id=CVE-2018-13405
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1779923