CVE-2016-7097

Published: Oct 16, 2016Modified: May 6, 2026

4.4

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.8 / Impact: 2.5

Source: NVD

Description

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.

Affected (1)

Products: Linux: Linux Kernel

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 4.8.2

Related CWEs

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (34)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef

Source: secalert@redhat.com

Issue TrackingPatch

http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2

Source: secalert@redhat.com

Patch

http://rhn.redhat.com/errata/RHSA-2017-0817.html

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/08/26/3

Source: secalert@redhat.com

Mailing List

http://www.securityfocus.com/bid/92659

Source: secalert@redhat.com

http://www.securitytracker.com/id/1038201

Source: secalert@redhat.com

http://www.spinics.net/lists/linux-fsdevel/msg98328.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.ubuntu.com/usn/USN-3146-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-3146-2

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-3147-1

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:1842

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:2077

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:2669

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1368938

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/torvalds/linux/commit/073931017b49d9458aa351605b43a7e34598caef

Source: secalert@redhat.com

PatchThird Party Advisory

https://source.android.com/security/bulletin/2017-04-01

Source: secalert@redhat.com

https://support.f5.com/csp/article/K31603170?utm_source=f5support&amp%3Butm_medium=RSS

Source: secalert@redhat.com

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://rhn.redhat.com/errata/RHSA-2017-0817.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/08/26/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.securityfocus.com/bid/92659

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1038201

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.spinics.net/lists/linux-fsdevel/msg98328.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.ubuntu.com/usn/USN-3146-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-3146-2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-3147-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2017:1842

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2017:2077

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2017:2669

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1368938

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/torvalds/linux/commit/073931017b49d9458aa351605b43a7e34598caef

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://source.android.com/security/bulletin/2017-04-01

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.f5.com/csp/article/K31603170?utm_source=f5support&amp%3Butm_medium=RSS

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.