CVE-2014-8989 Privilege escalation in n/a
Local attackers can bypass file permissions and escalate privileges by exploiting a flaw in supplemental group membership handling within Linux kernel namespaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8989?
CVE-2014-8989 is a medium-severity vulnerability in Linux kernel, published on 30 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
Weakness: CWE-264
Which versions are affected by CVE-2014-8989?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2014-8989?
Apply the vendor's patch.
Is CVE-2014-8989 being exploited?
There is no known exploitation of CVE-2014-8989 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2014-8989, GHSA-86g9-4xm6-2vw3, UBUNTU-CVE-2014-8989.