CVE-2018-13405
HIGHLinux Kernel < 3.16 - Privilege Escalation via SGID Directory Inode Initialization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-13405. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit demonstrates a privilege escalation vulnerability (CVE-2018-13405) in Linux kernels where setgid directories allow unauthorized file creation with elevated group permissions. The PoC uses `fallocate()` and `mmap()` to bypass the kernel's privilege-dropping logic, enabling arbitrary file writes with elevated group ownership.
Description
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
Exploits (1)
This exploit demonstrates a privilege escalation vulnerability (CVE-2018-13405) in Linux kernels where setgid directories allow unauthorized file creation with elevated group permissions. The PoC uses `fallocate()` and `mmap()` to bypass the kernel's privilege-dropping logic, enabling arbitrary file writes with elevated group ownership.
References (28)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H