6.2
CVSSv2

CVE-2015-3339

Published: 27/05/2015 Updated: 07/11/2023
CVSS v2 Base Score: 6.2 | Impact Score: 10 | Exploitability Score: 1.9
VMScore: 552
Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Summary

Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel prior to 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

debian debian linux 8.0

debian debian linux 7.0

Vendor Advisories

Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix multiple security issues, address severalhundred bugs, and add numerous enhancements are now available as part ofthe ongoing support and maintenance of Red H ...
Synopsis Important: kernel-rt security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Updated kernel-rt packages that fix multiple security issues, several bugs,and add various enhancements are now available for Red Hat EnterpriseLinux 7Red Hat Product Security has rated ...
Debian Bug report logs - #782515 [regression] BUG in process context when using TCP Fast Open (CVE-2015-2015-3332) Package: src:linux; Maintainer for src:linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: Antti Salmela <asalmela@ikifi> Date: Mon, 13 Apr 2015 14:48:02 UTC Severity: important ...
Debian Bug report logs - #782561 Buffer overruns in Linux kernel RFC4106 implementation using AESNI (CVE-2015-3331) Package: src:linux; Maintainer for src:linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: Romain Francoise <rfrancoise@debianorg> Date: Tue, 14 Apr 2015 08:57:02 UTC Severity: n ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2014-8159 It was found that the Linux kernel's InfiniBand/RDMA subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
The system could be made to run programs as an administrator ...
Several security issues were fixed in the kernel ...
The system could be made to run programs as an administrator ...
A race condition flaw was found between the chown and execve system calls When changing the owner of a setuid user binary to root, the race condition could momentarily make the binary setuid root A local, unprivileged user could potentially use this flaw to escalate their privileges on the system ...