NexaPulse
Subscribe
4.4mediumMedium

CVE-2021-4037

Linux Linux Kernel

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, an ordinary user account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
4.4 (v3.1)
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-284
Assigned by
secalert@redhat.com

Dates

Published
2022-08-24
Last modified
2026-08-10
Sources
NVD

Affected products

  • Linux Linux Kernel- 5.11
  • Debian Debian Linux10.0, 11.0

As listed in the NVD configuration data. Not a statement about your estate.

References