Description
Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html ↗
- http://www.securitytracker.com/id/1032412 ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1214030 ↗
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html ↗
- http://www.debian.org/security/2015/dsa-3237 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html ↗
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html ↗
- http://www.openwall.com/lists/oss-security/2015/04/20/5 ↗
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6 ↗
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 ↗
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html ↗
- http://rhn.redhat.com/errata/RHSA-2015-1272.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html ↗
- https://github.com/torvalds/linux/commit/8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 ↗