Skip to content
Heist/ feed
High

exec: Fix ToCToU between perm check and set-uid/gid usage

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod,

Announced Source revision 1
Original source ↗

CVE-2024-43882

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-43882

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "d5c3c7e26275a2d83b894d30f7582a42853a958f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "368f6985d46657b8b466a421dddcacd4051f7ada",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "15469d46ba34559bfe7e3de6659115778c624759",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "9b424c5d4130d56312e2a3be17efb0928fec4d64",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "d2a2a4714d80d09b0f8eb6438ab4224690b7121e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
        "lessThan": "f50733b45d865f91db90919f8311e2127ce5a0cb",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/exec.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.19.320",
        "versionType": "semver",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.282",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.224",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.165",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.106",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.47",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.10.6",
        "versionType": "semver",
        "lessThanOrEqual": "6.10.*"
      },
      {
        "status": "unaffected",
        "version": "6.11",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/exec.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-43882

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26695 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement