NVD

Id
38000  
Name
CVE-2013-1858  
Description
The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2013-04-05  
Modified Date
2013-04-08  
Seq
2013-1858  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
194093 38000 CVE-2013-1858 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e66eded8309ebf679d3d3c1f5820d1f2ca332c71  View
194094 38000 CVE-2013-1858 http://stealth.openwall.net/xSports/clown-newuser.c  View
194095 38000 CVE-2013-1858 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3  View
194096 38000 CVE-2013-1858 [oss-security] 20130314 Re: CLONE_NEWUSER|CLONE_FS root exploit  View
194097 38000 CVE-2013-1858 https://bugzilla.redhat.com/show_bug.cgi?id=921448  View
194098 38000 CVE-2013-1858 https://github.com/torvalds/linux/commit/e66eded8309ebf679d3d3c1f5820d1f2ca332c71  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20583 JVNDB-2013-002158 Linux Kernel の clone システムコールの実装における権限を取得される脆弱性 Linux Kernel の clone システムコールの実装は、CLONE_NEWUSER と CLONE_FS フラグの組み合わせを適切に処理しないため、権限を取得される脆弱性が存在します。 CVE-2013-1858 61800 CVE-2013-1858 38000 7.2 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002158.html 2013-03-14 2013-04-09 View