CVE-2021-4037Medium· 4.4▾ SunlitA vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permis…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.
linux_kernel < 5.11debian_linux = 10.0debian_linux = 11.0Upgrade past the affected range:
linux_kernel 5.11Connected by shared product, vendor, weakness, or advisory.
CVE-2022-3635Medium· 5.5A vulnerability, which was classified as critical, has been found in Linux Kernel
CVE-2022-3625Medium· 4.6A vulnerability was found in Linux Kernel
CVE-2022-3586Medium· 5.5A flaw was found in the Linux kernel’s networking code
CVE-2022-3621Medium· 4.3A vulnerability was found in Linux Kernel
CVE-2022-3303Medium· 4.7A race condition flaw was found in the Linux kernel sound subsystem due to improper locking
CVE-2022-2663Medium· 5.3An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message