cve-2024-43882
Vulnerability from cvelistv5
Published
2024-08-21 00:10
Modified
2024-12-19 09:17
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod, and when the chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid to root, violating the expressed authorization of "only cdrom group members can setuid to root". Re-check that we still have execute permissions in case the metadata has changed. It would be better to keep a copy from the perm-check time, but until we can do that refactoring, the least-bad option is to do a full inode_permission() call (under inode lock). It is understood that this is safe against dead-locks, but hardly optimal.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7adaPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cbPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1Patch
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-43882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-10T04:55:56.573367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T18:58:31.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5c3c7e26275a2d83b894d30f7582a42853a958f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "368f6985d46657b8b466a421dddcacd4051f7ada",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "15469d46ba34559bfe7e3de6659115778c624759",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9b424c5d4130d56312e2a3be17efb0928fec4d64",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d2a2a4714d80d09b0f8eb6438ab4224690b7121e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f50733b45d865f91db90919f8311e2127ce5a0cb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Fix ToCToU between perm check and set-uid/gid usage\n\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file\u0027s metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\n\nFor example, if a file could change permissions from executable and not\nset-id:\n\n---------x 1 root root 16048 Aug  7 13:16 target\n\nto set-id and non-executable:\n\n---S------ 1 root root 16048 Aug  7 13:16 target\n\nit is possible to gain root privileges when execution should have been\ndisallowed.\n\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \"chmod o-x,u+s target\" makes \"target\" executable only\nby uid \"root\" and gid \"cdrom\", while also becoming setuid-root:\n\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\n\nbecomes:\n\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\n\nBut racing the chmod means users without group \"cdrom\" membership can\nget the permission to execute \"target\" just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \"only cdrom\ngroup members can setuid to root\".\n\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:17:45.419Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958f"
        },
        {
          "url": "https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121e"
        },
        {
          "url": "https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cb"
        }
      ],
      "title": "exec: Fix ToCToU between perm check and set-uid/gid usage",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43882",
    "datePublished": "2024-08-21T00:10:49.556Z",
    "dateReserved": "2024-08-17T09:11:59.287Z",
    "dateUpdated": "2024-12-19T09:17:45.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43882\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T01:15:12.340\",\"lastModified\":\"2024-12-10T19:15:26.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nexec: Fix ToCToU between perm check and set-uid/gid usage\\n\\nWhen opening a file for exec via do_filp_open(), permission checking is\\ndone against the file\u0027s metadata at that moment, and on success, a file\\npointer is passed back. Much later in the execve() code path, the file\\nmetadata (specifically mode, uid, and gid) is used to determine if/how\\nto set the uid and gid. However, those values may have changed since the\\npermissions check, meaning the execution may gain unintended privileges.\\n\\nFor example, if a file could change permissions from executable and not\\nset-id:\\n\\n---------x 1 root root 16048 Aug  7 13:16 target\\n\\nto set-id and non-executable:\\n\\n---S------ 1 root root 16048 Aug  7 13:16 target\\n\\nit is possible to gain root privileges when execution should have been\\ndisallowed.\\n\\nWhile this race condition is rare in real-world scenarios, it has been\\nobserved (and proven exploitable) when package managers are updating\\nthe setuid bits of installed programs. Such files start with being\\nworld-executable but then are adjusted to be group-exec with a set-uid\\nbit. For example, \\\"chmod o-x,u+s target\\\" makes \\\"target\\\" executable only\\nby uid \\\"root\\\" and gid \\\"cdrom\\\", while also becoming setuid-root:\\n\\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\\n\\nbecomes:\\n\\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\\n\\nBut racing the chmod means users without group \\\"cdrom\\\" membership can\\nget the permission to execute \\\"target\\\" just before the chmod, and when\\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\\nsetuid to root, violating the expressed authorization of \\\"only cdrom\\ngroup members can setuid to root\\\".\\n\\nRe-check that we still have execute permissions in case the metadata\\nhas changed. It would be better to keep a copy from the perm-check time,\\nbut until we can do that refactoring, the least-bad option is to do a\\nfull inode_permission() call (under inode lock). It is understood that\\nthis is safe against dead-locks, but hardly optimal.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: exec: corrige ToCToU entre la verificaci\u00f3n permanente y el uso de set-uid/gid Al abrir un archivo para exec a trav\u00e9s de do_filp_open(), la verificaci\u00f3n de permisos se realiza con los metadatos del archivo en ese momento, y en caso de \u00e9xito, se devuelve un puntero de archivo. Mucho m\u00e1s adelante en la ruta del c\u00f3digo execve(), los metadatos del archivo (espec\u00edficamente modo, uid y gid) se utilizan para determinar si y c\u00f3mo configurar uid y gid. Sin embargo, es posible que esos valores hayan cambiado desde la verificaci\u00f3n de permisos, lo que significa que la ejecuci\u00f3n puede obtener privilegios no deseados. Por ejemplo, si un archivo pudiera cambiar los permisos de ejecutable y no de set-id: ---------x 1 root root 16048 7 de agosto 13:16 destino a set-id y no ejecutable: ---S ------ 1 root root 16048 7 de agosto 13:16 target es posible obtener privilegios de root cuando la ejecuci\u00f3n no deber\u00eda haberse permitido. Si bien esta condici\u00f3n de ejecuci\u00f3n es poco com\u00fan en escenarios del mundo real, se ha observado (y se ha demostrado que es explotable) cuando los administradores de paquetes actualizan los bits setuid de los programas instalados. Dichos archivos comienzan siendo ejecutables mundialmente, pero luego se ajustan para que sean ejecutables en grupo con un bit set-uid. Por ejemplo, \\\"chmod ox,u+s target\\\" hace que \\\"target\\\" sea ejecutable s\u00f3lo mediante uid \\\"root\\\" y gid \\\"cdrom\\\", y al mismo tiempo se convierte en setuid-root: -rwxr-xr-x 1 root cdrom 16048 7 de agosto de 13: 16 objetivo se convierte en: -rwsr-xr-- 1 cdrom ra\u00edz 16048 7 de agosto 13:16 objetivo Pero competir con el chmod significa que los usuarios sin membres\u00eda del grupo \\\"cdrom\\\" pueden obtener permiso para ejecutar \\\"destino\\\" justo antes del chmod, y cuando el chmod finaliza, el ejecutivo llega a brpm_fill_uid() y realiza el setuid como root, violando la autorizaci\u00f3n expresa de \\\"s\u00f3lo los miembros del grupo cdrom pueden setuid como root\\\". Vuelva a verificar que todav\u00eda tengamos permisos de ejecuci\u00f3n en caso de que los metadatos hayan cambiado. Ser\u00eda mejor conservar una copia del momento de verificaci\u00f3n permanente, pero hasta que podamos hacer esa refactorizaci\u00f3n, la opci\u00f3n menos mala es hacer una llamada completa a inode_permission() (bajo bloqueo de inodo). Se entiende que esto es seguro contra bloqueos mutuos, pero no es \u00f3ptimo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.320\",\"matchCriteriaId\":\"0B4EF915-550B-45E5-B2CA-648FEACD60FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.282\",\"matchCriteriaId\":\"A8961D98-9ACF-4188-BA88-44038B14BC28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"5CCEDF13-293D-4E64-B501-4409D0365AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"B4E2B568-3171-41DE-B519-F2B1A3600D94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.106\",\"matchCriteriaId\":\"3F3AF3DA-1553-4AB8-97CC-7D0C91E4E23F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.47\",\"matchCriteriaId\":\"F450D4D2-61CE-4595-B7D1-CA382E2028E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.6\",\"matchCriteriaId\":\"C1CDF130-CCA6-47F6-9718-8949BF4E05CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-10T04:55:56.573367Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.613Z\"}}], \"cna\": {\"title\": \"exec: Fix ToCToU between perm check and set-uid/gid usage\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"d5c3c7e26275a2d83b894d30f7582a42853a958f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"368f6985d46657b8b466a421dddcacd4051f7ada\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"15469d46ba34559bfe7e3de6659115778c624759\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"9b424c5d4130d56312e2a3be17efb0928fec4d64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"d2a2a4714d80d09b0f8eb6438ab4224690b7121e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"f50733b45d865f91db90919f8311e2127ce5a0cb\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/exec.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.106\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.47\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/exec.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958f\"}, {\"url\": \"https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada\"}, {\"url\": \"https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759\"}, {\"url\": \"https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64\"}, {\"url\": \"https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1\"}, {\"url\": \"https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121e\"}, {\"url\": \"https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e\"}, {\"url\": \"https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cb\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nexec: Fix ToCToU between perm check and set-uid/gid usage\\n\\nWhen opening a file for exec via do_filp_open(), permission checking is\\ndone against the file\u0027s metadata at that moment, and on success, a file\\npointer is passed back. Much later in the execve() code path, the file\\nmetadata (specifically mode, uid, and gid) is used to determine if/how\\nto set the uid and gid. However, those values may have changed since the\\npermissions check, meaning the execution may gain unintended privileges.\\n\\nFor example, if a file could change permissions from executable and not\\nset-id:\\n\\n---------x 1 root root 16048 Aug  7 13:16 target\\n\\nto set-id and non-executable:\\n\\n---S------ 1 root root 16048 Aug  7 13:16 target\\n\\nit is possible to gain root privileges when execution should have been\\ndisallowed.\\n\\nWhile this race condition is rare in real-world scenarios, it has been\\nobserved (and proven exploitable) when package managers are updating\\nthe setuid bits of installed programs. Such files start with being\\nworld-executable but then are adjusted to be group-exec with a set-uid\\nbit. For example, \\\"chmod o-x,u+s target\\\" makes \\\"target\\\" executable only\\nby uid \\\"root\\\" and gid \\\"cdrom\\\", while also becoming setuid-root:\\n\\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\\n\\nbecomes:\\n\\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\\n\\nBut racing the chmod means users without group \\\"cdrom\\\" membership can\\nget the permission to execute \\\"target\\\" just before the chmod, and when\\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\\nsetuid to root, violating the expressed authorization of \\\"only cdrom\\ngroup members can setuid to root\\\".\\n\\nRe-check that we still have execute permissions in case the metadata\\nhas changed. It would be better to keep a copy from the perm-check time,\\nbut until we can do that refactoring, the least-bad option is to do a\\nfull inode_permission() call (under inode lock). It is understood that\\nthis is safe against dead-locks, but hardly optimal.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:17:45.419Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:17:45.419Z\", \"dateReserved\": \"2024-08-17T09:11:59.287Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T00:10:49.556Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.