The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
[
{
"id": "CVE-2018-13405-d55e9c5e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/inode.c"
},
"digest": {
"line_hashes": [
"56289590247260689716075216337893445230",
"181881191910643226634036536992678615471",
"286960857080910926976707544565713622832",
"180019755580562937065312454050677812048",
"18040660402559416350869630779882658664",
"15544113592705489570894747151139159268"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7"
},
{
"id": "CVE-2018-13405-d708755a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/inode.c",
"function": "inode_init_owner"
},
"digest": {
"function_hash": "74353457159367498983847058097463180715",
"length": 292.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7"
}
]
[
{
"id": "CVE-2018-13405-91469ed2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/inode.c",
"function": "inode_init_owner"
},
"digest": {
"function_hash": "74353457159367498983847058097463180715",
"length": 292.0
},
"source": "https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7"
},
{
"id": "CVE-2018-13405-dd480402",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/inode.c"
},
"digest": {
"line_hashes": [
"56289590247260689716075216337893445230",
"181881191910643226634036536992678615471",
"286960857080910926976707544565713622832",
"180019755580562937065312454050677812048",
"18040660402559416350869630779882658664",
"15544113592705489570894747151139159268"
],
"threshold": 0.9
},
"source": "https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7"
}
]