The simplesetacl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.
[
{
"target": {
"file": "fs/posix_acl.c"
},
"id": "CVE-2017-5551-1f2d018c",
"deprecated": false,
"digest": {
"line_hashes": [
"262683076484424620633541197915275069554",
"279876644282197826274582970621355297411",
"134203373702725443308050044930684571812",
"263525836844546685049236291297772112241",
"20285039858530535541832751300906813184",
"190870308499154396014773847341562998139",
"138326788927114611859379062236937197443",
"143683975983742713134950773071910206283"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@497de07d89c1410d76a15bec2bb41f24a2a89f31",
"signature_version": "v1"
},
{
"target": {
"function": "simple_set_acl",
"file": "fs/posix_acl.c"
},
"id": "CVE-2017-5551-df213c28",
"deprecated": false,
"digest": {
"length": 306.0,
"function_hash": "227610080773885259616909566076612216202"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@497de07d89c1410d76a15bec2bb41f24a2a89f31",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5551.json"
[
{
"target": {
"function": "simple_set_acl",
"file": "fs/posix_acl.c"
},
"id": "CVE-2017-5551-2e3019f2",
"deprecated": false,
"digest": {
"length": 306.0,
"function_hash": "227610080773885259616909566076612216202"
},
"signature_type": "Function",
"source": "https://github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31",
"signature_version": "v1"
},
{
"target": {
"file": "fs/posix_acl.c"
},
"id": "CVE-2017-5551-ba262b70",
"deprecated": false,
"digest": {
"line_hashes": [
"262683076484424620633541197915275069554",
"279876644282197826274582970621355297411",
"134203373702725443308050044930684571812",
"263525836844546685049236291297772112241",
"20285039858530535541832751300906813184",
"190870308499154396014773847341562998139",
"138326788927114611859379062236937197443",
"143683975983742713134950773071910206283"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5551.json"