Strix
26.1K

CVE-2018-13405

HIGHCVSS 7.8/10EPSS 1.02%

Last modified

CVE-2018-13405 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. EPSS estimates a 1.02% chance of exploitation in the next 30 days.

Description

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.02%

58.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LinuxLinux Kernel<= 3.16
DebianDebian Linux8.0
DebianDebian Linux9.0
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
FedoraprojectFedora34
FedoraprojectFedora35
RedhatMrg Realtime2.0
RedhatVirtualization4.0
RedhatEnterprise Linux Aus7.4
RedhatEnterprise Linux Desktop6.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Eus7.4
RedhatEnterprise Linux Eus7.5
RedhatEnterprise Linux For Real Time7
RedhatEnterprise Linux Server6.0
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Server Aus6.6
RedhatEnterprise Linux Server Aus7.2
RedhatEnterprise Linux Server Aus7.3
RedhatEnterprise Linux Server Tus7.2
RedhatEnterprise Linux Server Tus7.3
RedhatEnterprise Linux Server Tus7.4
RedhatEnterprise Linux Workstation6.0
RedhatEnterprise Linux Workstation7.0
F5Big-Ip Access Policy Manager>= 13.0.0, < 13.1.3.5
F5Big-Ip Access Policy Manager>= 14.0.0, < 14.1.3.1
F5Big-Ip Access Policy Manager>= 15.0.0, < 15.0.1.4
F5Big-Ip Access Policy Manager15.1.0
F5Big-Ip Access Policy Manager16.0.0
F5Big-Ip Advanced Firewall Manager>= 13.0.0, < 13.1.3.5
F5Big-Ip Advanced Firewall Manager>= 14.0.0, < 14.1.3.1
F5Big-Ip Advanced Firewall Manager>= 15.0.0, < 15.0.1.4
F5Big-Ip Advanced Firewall Manager15.1.0
F5Big-Ip Advanced Firewall Manager16.0.0
F5Big-Ip Analytics>= 13.0.0, < 13.1.3.5
F5Big-Ip Analytics>= 14.0.0, < 14.1.3.1
F5Big-Ip Analytics>= 15.0.0, < 15.0.1.4
F5Big-Ip Analytics15.1.0
F5Big-Ip Analytics16.0.0
F5Big-Ip Application Acceleration Manager>= 13.0.0, < 13.1.3.5
F5Big-Ip Application Acceleration Manager>= 14.0.0, < 14.1.3.1
F5Big-Ip Application Acceleration Manager>= 15.0.0, < 15.0.1.4
F5Big-Ip Application Acceleration Manager15.1.0
F5Big-Ip Application Acceleration Manager16.0.0
F5Big-Ip Application Security Manager>= 13.0.0, < 13.1.3.5
F5Big-Ip Application Security Manager>= 14.0.0, < 14.1.3.1
F5Big-Ip Application Security Manager>= 15.0.0, < 15.0.1.4
F5Big-Ip Application Security Manager15.1.0

Showing 50 of 91 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-13405?
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
How severe is CVE-2018-13405?
CVE-2018-13405 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 1.02% probability of exploitation in the next 30 days.
How do I fix CVE-2018-13405?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-13405?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST