Description
An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root access.
References (3)
Core 3
Core References
Exploit, Mailing List, Vendor Advisory x_refsource_misc
https://lists.gnu.org/archive/html/bug-hurd/2021-05/msg00079.html
Mailing List x_refsource_misc
https://www.mail-archive.com/bug-hurd%40gnu.org/msg32112.html
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://salsa.debian.org/hurd-team/hurd/-/blob/4d1b079411e2f40576e7b58f9b5b78f733a2beda/debian/patches/0034-proc-Use-UIDs-for-evaluating-permissions.patch
Scores
CVSS v3
7.5
EPSS
0.0045
EPSS Percentile
64.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-362
Status
published
Products (1)
gnu/hurd
< 0.9.20210404-9
Published
Nov 07, 2021
Tracked Since
Feb 18, 2026