CVE-2018-13405 json
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ow…
published 2018-07-06 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-5348
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 1
- Exploit-DB
Summary
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
Patch / fix
- f5 big-ip_access_policy_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_advanced_firewall_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_analytics 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_application_acceleration_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_application_security_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_domain_name_system 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_edge_gateway 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_fraud_protection_service 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_global_traffic_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_link_controller 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_local_traffic_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_policy_enforcement_manager 13.1.3.5, 14.1.3.1, 15.0.1.4
- f5 big-ip_webaccelerator 13.1.3.5, 14.1.3.1, 15.0.1.4
- linux Debian 14, Debian 13, Debian 12 4.17.6-1
debian advisories DEBIAN-CVE-2018-13405
- linux Ubuntu 14.04 LTS 3.13.0-157.207
- linux Ubuntu 16.04 LTS 4.4.0-134.160
- linux Ubuntu 18.04 LTS 4.15.0-33.36
- linux-aws Ubuntu 14.04 LTS 4.4.0-1028.31
- linux-aws Ubuntu 16.04 LTS 4.4.0-1066.76
- linux-aws Ubuntu 18.04 LTS 4.15.0-1020.20
- linux-gcp Ubuntu 16.04 LTS 4.15.0-1018.19~16.04.2
- linux-gcp Ubuntu 18.04 LTS 4.15.0-1018.19
ubuntu advisories UBUNTU-CVE-2018-13405
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-alt RHEL 7 4.14.0-115.el7a
- perf RHEL 7 4.14.0-115.el7a
- kernel RHEL 7 4.14.0-115.el7a
- python-perf RHEL 7 4.14.0-115.el7a
- kernel-tools RHEL 7 4.14.0-115.el7a
- kernel-tools-libs RHEL 7 4.14.0-115.el7a
- kernel-bootwrapper RHEL 7 4.14.0-115.el7a
- kernel-abi-whitelists RHEL 7 4.14.0-115.el7a
red hat advisories RHSA-2018:2948RHSA-2019:4159RHSA-2019:4164RHSA-2019:2476RHSA-2019:2730RHSA-2019:2696
- kernel-syms SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.83.2
- kernel-source SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.83.2
- kernel-default SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLE Live Patching 12 SP4 +3 more 4.12.14-95.83.2
- kernel-syms SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.150.1
- kernel-source SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.150.1
- kernel-default SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.150.1
- kgraft-patch-SLE12-SP3_Update_41 SLES for SAP 12 SP3, SLES 12 SP3-LTSS, OpenStack Cloud Crowbar 8 +2 more 1-4.3.1
- kernel-syms SLES 12 SP2-BCL 4.4.121-92.161.1
suse advisories SUSE-SU-2021:3972-1SUSE-SU-2021:3935-1SUSE-SU-2021:3929-1SUSE-SU-2021:3876-1SUSE-SU-2021:3748-1SUSE-SU-2021:3723-1
- kernel-default openSUSE Leap 15.3 4.12.14-197.102.2
- kernel-vanilla openSUSE Leap 15.3 4.12.14-197.102.2
- kernel-kvmsmall openSUSE Leap 15.3 4.12.14-197.102.2
- kernel-zfcpdump openSUSE Leap 15.3 4.12.14-197.102.2
- kernel-syms openSUSE Leap 15.2 5.3.18-lp152.102.1
- kernel-obs-qa openSUSE Leap 15.2 5.3.18-lp152.102.1
- kernel-source openSUSE Leap 15.2 5.3.18-lp152.102.1
- kernel-default openSUSE Leap 15.2 5.3.18-lp152.102.1
opensuse advisories openSUSE-SU-2021:3876-1openSUSE-SU-2021:1477-1
- kernel AlmaLinux 8 4.18.0-372.9.1.el8
- perf AlmaLinux 8 4.18.0-372.9.1.el8
- bpftool AlmaLinux 8 4.18.0-372.9.1.el8
- kernel-core AlmaLinux 8 4.18.0-372.9.1.el8
- kernel-tools AlmaLinux 8 4.18.0-372.9.1.el8
- python3-perf AlmaLinux 8 4.18.0-372.9.1.el8
- kernel-modules AlmaLinux 8 4.18.0-372.9.1.el8
- kernel-debug-core AlmaLinux 8 4.18.0-372.9.1.el8
almalinux advisories ALSA-2022:1988ALSA-2022:0886
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-13405 updated cvss 4.4
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
-
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmwareaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-957.el7, kernel 3.10.0-957.el7, bpftool 3.10.0-957.el7, python-perf 3.10.0-957.el7, kernel-tools 3.10.0-957.el7, kernel-tools-libs 3.10.0-957.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-957.el7, kernel 3.10.0-957.el7, bpftool 3.10.0-957.el7, python-perf 3.10.0-957.el7, kernel-tools 3.10.0-957.el7, kernel-tools-libs 3.10.0-957.el7, +2 morefixed: vendor fix RHSA-2018:3083
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) perf 3.10.0-693.58.1.el7, kernel 3.10.0-693.58.1.el7, python-perf 3.10.0-693.58.1.el7, kernel-tools 3.10.0-693.58.1.el7, kernel-tools-libs 3.10.0-693.58.1.el7, kernel-abi-whitelists 3.10.0-693.58.1.el7, +1 morefixed: vendor fix RHSA-2019:2696
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perf 3.10.0-862.41.1.el7, kernel 3.10.0-862.41.1.el7, python-perf 3.10.0-862.41.1.el7, kernel-tools 3.10.0-862.41.1.el7, kernel-tools-libs 3.10.0-862.41.1.el7, kernel-abi-whitelists 3.10.0-862.41.1.el7, +1 morefixed: vendor fix RHSA-2019:2566
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.el7fixed: vendor fix RHSA-2018:3083
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.58.1.el7fixed: vendor fix RHSA-2019:2696
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) kernel-debuginfo-common-x86_64 3.10.0-862.41.1.el7fixed: vendor fix RHSA-2019:2566
-
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-754.12.1.el6, kernel 2.6.32-754.12.1.el6, kernel-firmware 2.6.32-754.12.1.el6, kernel-abi-whitelists 2.6.32-754.12.1.el6, kernel-debuginfo-common-i686 2.6.32-754.12.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.12.1.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-754.12.1.el6, kernel-debuginfo-common-i686 2.6.32-754.12.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.12.1.el6fixed: vendor fix RHSA-2019:0717
show 24 moreshow fewer
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perf 3.10.0-957.el7, perf 4.14.0-115.el7a, kernel 3.10.0-957.el7, kernel 4.14.0-115.el7a, kernel-alt 4.14.0-115.el7a, python-perf 3.10.0-957.el7, +13 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debuginfo-common-ppc64le 3.10.0-957.el7, kernel-debuginfo-common-ppc64le 4.14.0-115.el7afixed: vendor fix RHSA-2018:3083
-
Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-957.rt56.910.el7, kernel-rt-trace 3.10.0-957.rt56.910.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-957.rt56.910.el7, kernel-rt-kvm 3.10.0-957.rt56.910.el7, kernel-rt-trace 3.10.0-957.rt56.910.el7, kernel-rt-debug-kvm 3.10.0-957.rt56.910.el7, kernel-rt-trace-kvm 3.10.0-957.rt56.910.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-957.rt56.910.el7fixed: vendor fix RHSA-2018:3096
-
Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-754.12.1.el6, kernel 2.6.32-754.12.1.el6, kernel-firmware 2.6.32-754.12.1.el6, kernel-abi-whitelists 2.6.32-754.12.1.el6, kernel-debuginfo-common-i686 2.6.32-754.12.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.12.1.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-754.12.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.12.1.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-754.12.1.el6, kernel 2.6.32-754.12.1.el6, kernel-kdump 2.6.32-754.12.1.el6, kernel-firmware 2.6.32-754.12.1.el6, kernel-bootwrapper 2.6.32-754.12.1.el6, kernel-abi-whitelists 2.6.32-754.12.1.el6, +4 morefixed: vendor fix RHSA-2019:0717
-
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-957.el7, kernel 3.10.0-957.el7, bpftool 3.10.0-957.el7, python-perf 3.10.0-957.el7, kernel-kdump 3.10.0-957.el7, kernel-tools 3.10.0-957.el7, +7 morefixed: vendor fix RHSA-2018:3083
-
Red Hat Enterprise Linux Server AUS (v. 6.6) perf 2.6.32-504.80.2.el6, kernel 2.6.32-504.80.2.el6, kernel-firmware 2.6.32-504.80.2.el6, kernel-abi-whitelists 2.6.32-504.80.2.el6, kernel-debuginfo-common-x86_64 2.6.32-504.80.2.el6fixed: vendor fix RHSA-2019:2476
-
Red Hat Enterprise Linux Server AUS (v. 7.2) perf 3.10.0-327.83.1.el7, kernel 3.10.0-327.83.1.el7, python-perf 3.10.0-327.83.1.el7, kernel-tools 3.10.0-327.83.1.el7, kernel-tools-libs 3.10.0-327.83.1.el7, kernel-abi-whitelists 3.10.0-327.83.1.el7, +1 morefixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server AUS (v. 7.3) perf 3.10.0-514.71.1.el7, kernel 3.10.0-514.71.1.el7, python-perf 3.10.0-514.71.1.el7, kernel-tools 3.10.0-514.71.1.el7, kernel-tools-libs 3.10.0-514.71.1.el7, kernel-abi-whitelists 3.10.0-514.71.1.el7, +1 morefixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server E4S (v. 7.2) perf 3.10.0-327.83.1.el7, kernel 3.10.0-327.83.1.el7, python-perf 3.10.0-327.83.1.el7, kernel-tools 3.10.0-327.83.1.el7, kernel-tools-libs 3.10.0-327.83.1.el7, kernel-abi-whitelists 3.10.0-327.83.1.el7, +1 morefixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server E4S (v. 7.3) perf 3.10.0-514.71.1.el7, kernel 3.10.0-514.71.1.el7, python-perf 3.10.0-514.71.1.el7, kernel-tools 3.10.0-514.71.1.el7, kernel-tools-libs 3.10.0-514.71.1.el7, kernel-bootwrapper 3.10.0-514.71.1.el7, +3 morefixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server EUS (v. 7.4) perf 3.10.0-693.58.1.el7, kernel 3.10.0-693.58.1.el7, python-perf 3.10.0-693.58.1.el7, kernel-kdump 3.10.0-693.58.1.el7, kernel-tools 3.10.0-693.58.1.el7, kernel-tools-libs 3.10.0-693.58.1.el7, +6 morefixed: vendor fix RHSA-2019:2696
-
Red Hat Enterprise Linux Server EUS (v. 7.5) perf 3.10.0-862.41.1.el7, kernel 3.10.0-862.41.1.el7, python-perf 3.10.0-862.41.1.el7, kernel-kdump 3.10.0-862.41.1.el7, kernel-tools 3.10.0-862.41.1.el7, kernel-tools-libs 3.10.0-862.41.1.el7, +6 morefixed: vendor fix RHSA-2019:2566
-
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-754.12.1.el6, kernel-debuginfo-common-i686 2.6.32-754.12.1.el6, kernel-debuginfo-common-ppc64 2.6.32-754.12.1.el6, kernel-debuginfo-common-s390x 2.6.32-754.12.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.12.1.el6fixed: vendor fix RHSA-2019:0717
-
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-957.el7, kernel-debuginfo-common-x86_64 3.10.0-957.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.el7fixed: vendor fix RHSA-2018:3083
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.6) python-perf 2.6.32-504.80.2.el6, kernel-debuginfo-common-x86_64 2.6.32-504.80.2.el6fixed: vendor fix RHSA-2019:2476
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.83.1.el7fixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.71.1.el7fixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.83.1.el7fixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.71.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-514.71.1.el7fixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.4) kernel-debuginfo-common-ppc64 3.10.0-693.58.1.el7, kernel-debuginfo-common-x86_64 3.10.0-693.58.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.58.1.el7fixed: vendor fix RHSA-2019:2696
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) kernel-debuginfo-common-ppc64 3.10.0-862.41.1.el7, kernel-debuginfo-common-x86_64 3.10.0-862.41.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-862.41.1.el7fixed: vendor fix RHSA-2019:2566
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.83.1.el7fixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.71.1.el7fixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server TUS (v. 7.2) perf 3.10.0-327.83.1.el7, kernel 3.10.0-327.83.1.el7, python-perf 3.10.0-327.83.1.el7, kernel-tools 3.10.0-327.83.1.el7, kernel-tools-libs 3.10.0-327.83.1.el7, kernel-abi-whitelists 3.10.0-327.83.1.el7, +1 morefixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server TUS (v. 7.3) perf 3.10.0-514.71.1.el7, kernel 3.10.0-514.71.1.el7, python-perf 3.10.0-514.71.1.el7, kernel-tools 3.10.0-514.71.1.el7, kernel-tools-libs 3.10.0-514.71.1.el7, kernel-abi-whitelists 3.10.0-514.71.1.el7, +1 morefixed: vendor fix RHSA-2019:4159
5 more fixed, 6 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (EDB-45033)
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-45033 Linux (Ubuntu) - Other Users coredumps Can Be Read via setgid Directory and killpriv Bypass dos, 2018-07-16
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
- Technology feeds
References
-
git.kernel.org
/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7
patch, vendor-advisory
-
github.com
/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7
patch, third-party-advisory
-
git.kernel.org
/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840cd61c23e2b9241093737b4c395cb406
mailing-list, patch, vendor-advisory
-
openwall.com
/lists/oss-security/2018/07/13/2
mailing-list, patch, third-party-advisory
-
exploit-db.com
/exploits/45033/
exploit, third-party-advisory, vdb-entry
-
usn.ubuntu.com
/3752-2/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:3083
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3752-3/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3753-2/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3754-1/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:2948
vendor-advisory, third-party-advisory
-
debian.org
/security/2018/dsa-4266
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3752-1/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:3096
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3753-1/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0717
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2476
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2566
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2696
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2730
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:4159
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:4164
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/MTKKIAUMR5FAYLZ7HLEPOXMKAAE3BYBQ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/HRBNBX73SAFKQWBOX76SLMWPTKJPVGEJ/
vendor-advisory
-
twitter.com
/grsecurity/status/1015082951204327425
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2018/08/msg00014.html
mailing-list, third-party-advisory
-
securityfocus.com
/bid/106503
vdb-entry, broken-link
-
support.f5.com
/csp/article/K00854051
third-party-advisory
Sources
- CVE List CVE-2018-13405
- NVD CVE-2018-13405
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.