CVE-2008-4210
Linux Kernel < 2.6.22 - Privilege Escalation via Setuid/Setgid Bit Handling
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4210. PoCs published by gat3way.
AI-analyzed exploit summary This exploit leverages a Linux kernel vulnerability (CVE-2008-4210) in versions < 2.6.22 to achieve local privilege escalation by manipulating file truncation and memory mapping in a SGID directory. It copies a privileged shell (ash/sash) to a new file with SGID permissions set, allowing execution with elevated group privileges.
Description
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
Exploits (1)
This exploit leverages a Linux kernel vulnerability (CVE-2008-4210) in versions < 2.6.22 to achieve local privilege escalation by manipulating file truncation and memory mapping in a SGID directory. It copies a privileged shell (ash/sash) to a new file with SGID permissions set, allowing execution with elevated group privileges.