CVE-2018-13405 in Android
Zusammenfassung (Englisch)
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Reservieren
06.07.2018
Veröffentlichung
06.07.2018
Status
Bestätigt
Einträge
VulDB provides additional information and datapoints for this CVE: