CERT-MU Vulnerability Note VN-2008-11

Linux Kernel 'truncate()' Local Privilege Escalation Vulnerability

Original Issue Date: October 31, 2008

Severity Rating: High

Systems Affected

• Linux kernel versions prior to 2.6.22-rc1

Overview

A vulnerability has been reported in Linux Kernel which allows a local attacker to gain elevated privileges on the system caused by an error in open.c

Description

The vulnerability exists because, the "truncate()" and "ftruncate()" functions are not appropriately clearing the "suid" and "sgid" bits from files modified .An attacker could exploit this vulnerability by creating an executable file in a setgid directory using the truncate or ftruncate function in conjunction with memory-mapped I/O to gain the privileges of a different group, and hence launch further attacks.

Solution

• Upgrade to latest versions provided by the vendor.
  http://www.kernel.org/

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Vendor Information

kernel.org

http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

CVE-Name

CVE-2008-4210

References

IBM ISS X-force
http://xforce.iss.net/xforce/xfdb/45539

SecurityFocus
http://www.securityfocus.com/bid/31368