CVE-2018-13405 Privilege escalation in n/a
Local attackers can escalate privileges by creating SGID executable files in writable SGID directories due to incorrect group ownership assignment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13405?
CVE-2018-13405 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 6 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
Weakness: CWE-269
Which versions are affected by CVE-2018-13405?
It affects 27 products.
Linux distribution packages (40)
kernel Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-abi-whitelists Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-devel Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo-common-i686 Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo-common-x86_64 Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-devel Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-doc Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-firmware Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel-headers Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
perf Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
perf-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
python-perf Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
python-perf-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.6.32-754.12.1.el6 |
kernel Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-abi-whitelists Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo-common-i686 Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo-common-x86_64 Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-doc Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-firmware Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel-headers Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
perf Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
perf-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
python-perf Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
python-perf-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.6.32-754.12.1.el6 |
kernel Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-abi-whitelists Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-bootwrapper Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debug-devel Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
kernel-debuginfo-common-i686 Red Hat:enterprise_linux:6::server | All versions | 0:2.6.32-754.12.1.el6 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager and 21 more.
How do I fix CVE-2018-13405?
Apply the vendor's patch.
Is CVE-2018-13405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-13405 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2018-13405, GHSA-5p56-pcgw-42mf, RHSA-2019:0717, RHSA-2019:2566, UBUNTU-CVE-2018-13405.