CVE

Id
102371  
CVE No.
CVE-2017-5551  
Status
Candidate  
Description
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.  
Phase
Assigned (20170120)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
805069 102371 CVE-2017-5551 MLIST:[oss-security] 20170120 Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel  View
805070 102371 CVE-2017-5551 URL:http://www.openwall.com/lists/oss-security/2017/01/21/3  View
805071 102371 CVE-2017-5551 CONFIRM:http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31  View
805072 102371 CVE-2017-5551 CONFIRM:http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6  View
805073 102371 CVE-2017-5551 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1416126  View
805074 102371 CVE-2017-5551 CONFIRM:https://github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31  View
805075 102371 CVE-2017-5551 BID:95717  View

Related JVN