CVE - CVE-2008-3833

CVE-ID
CVE-2008-3833	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:31567 URL:http://www.securityfocus.com/bid/31567 MISC:32237 URL:http://secunia.com/advisories/32237 MISC:32485 URL:http://secunia.com/advisories/32485 MISC:32759 URL:http://secunia.com/advisories/32759 MISC:DSA-1653 URL:http://www.debian.org/security/2008/dsa-1653 MISC:RHSA-2008:0957 URL:http://www.redhat.com/support/errata/RHSA-2008-0957.html MISC:SUSE-SR:2008:025 URL:http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html MISC:[oss-security] 20081003 CVE-2008-3833 kernel: remove SUID when splicing into an inode URL:http://openwall.com/lists/oss-security/2008/10/03/1 MISC:http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git%3Ba=commit%3Bh=8c34e2d63231d4bf4852bac8521883944d770fe3 URL:http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git%3Ba=commit%3Bh=8c34e2d63231d4bf4852bac8521883944d770fe3 MISC:http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.19/ChangeLog-2.6.19-rc3 URL:http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.19/ChangeLog-2.6.19-rc3 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=464450 URL:https://bugzilla.redhat.com/show_bug.cgi?id=464450 MISC:kernel-genericfilesplice-priv-escalation(45922) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/45922 MISC:oval:org.mitre.oval:def:9980 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9980
Assigning CNA
Red Hat, Inc.
Date Record Created
20080827	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080827)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.