NVD

Id
3695  
Name
CVE-2008-3833  
Description
The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-10-03  
Modified Date
2013-08-21  
Seq
2008-3833  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
23345 3695 CVE-2008-3833 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git;a=commit;h=8c34e2d63231d4bf4852bac8521883944d770fe3  View
23346 3695 CVE-2008-3833 SUSE-SR:2008:025  View
23347 3695 CVE-2008-3833 [oss-security] 20081003 CVE-2008-3833 kernel: remove SUID when splicing into an inode  View
23348 3695 CVE-2008-3833 oval:org.mitre.oval:def:9980  View
23349 3695 CVE-2008-3833 DSA-1653  View
23350 3695 CVE-2008-3833 http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.19/ChangeLog-2.6.19-rc3  View
23351 3695 CVE-2008-3833 RHSA-2008:0957  View
23352 3695 CVE-2008-3833 31567  View
23353 3695 CVE-2008-3833 kernel-genericfilesplice-priv-escalation(45922)  View
23354 3695 CVE-2008-3833 https://bugzilla.redhat.com/show_bug.cgi?id=464450  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46614 JVNDB-2008-001924 Linux Kernel の generic_file_splice_write 関数における権限昇格の脆弱性 Linux Kernel の fs/splice.c における generic_file_splice_write 関数には、ファイルへの書き込みがある場合に、setuid および setgid ビットの除去処理に不備があるため、異なるグループの権限を取得される脆弱性が存在します。 CVE-2008-3833 33946 CVE-2008-3833 3695 4.9 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001924.html 2008-10-03 2009-02-05 View