CVE-2024-43882 (GCVE-0-2024-43882)
Vulnerability from cvelistv5
Published
2024-08-21 00:10
Modified
2026-08-05 11:36
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod, and when the chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid to root, violating the expressed authorization of "only cdrom group members can setuid to root". Re-check that we still have execute permissions in case the metadata has changed. It would be better to keep a copy from the perm-check time, but until we can do that refactoring, the least-bad option is to do a full inode_permission() call (under inode lock). It is understood that this is safe against dead-locks, but hardly optimal.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
Version: 9167b0b9a0ab7907191523f5a0528e3b9c288e21
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-43882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-10T04:55:56.573367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T18:58:31.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:06:36.516Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:57:09.220Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5c3c7e26275a2d83b894d30f7582a42853a958f",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "368f6985d46657b8b466a421dddcacd4051f7ada",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "15469d46ba34559bfe7e3de6659115778c624759",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "9b424c5d4130d56312e2a3be17efb0928fec4d64",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "d2a2a4714d80d09b0f8eb6438ab4224690b7121e",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            },
            {
              "lessThan": "f50733b45d865f91db90919f8311e2127ce5a0cb",
              "status": "affected",
              "version": "9167b0b9a0ab7907191523f5a0528e3b9c288e21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.106",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.47",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.6",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Fix ToCToU between perm check and set-uid/gid usage\n\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file\u0027s metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\n\nFor example, if a file could change permissions from executable and not\nset-id:\n\n---------x 1 root root 16048 Aug  7 13:16 target\n\nto set-id and non-executable:\n\n---S------ 1 root root 16048 Aug  7 13:16 target\n\nit is possible to gain root privileges when execution should have been\ndisallowed.\n\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \"chmod o-x,u+s target\" makes \"target\" executable only\nby uid \"root\" and gid \"cdrom\", while also becoming setuid-root:\n\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\n\nbecomes:\n\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\n\nBut racing the chmod means users without group \"cdrom\" membership can\nget the permission to execute \"target\" just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \"only cdrom\ngroup members can setuid to root\".\n\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the execve()/execveat() syscall path (do_execveat_common \u2192 bprm_execve \u2192 bprm_fill_uid), requiring local access to the system. No network protocol or remote data processing is involved.\nAC:L - The attacker fully controls their side of the race and can stall a permission-checked exec indefinitely, because copy_strings() for argv/envp runs after do_open_execat()\u0027s MAY_EXEC check and faults on attacker-owned pages (userfaultfd/FUSE-backed), so the exec can be parked until the setuid-adding chmod is observed via inotify; the exec loop can also simply be run continuously at no cost, and on typical desktop configurations the unprivileged attacker can trigger the package-manager operation themselves via PackageKit/polkit.\nPR:L - Requires only an unprivileged local account able to execute the target file at the moment of open (e.g. while it is still world-executable). No capabilities, no group membership, and no user-namespace tricks are needed.\nUI:N - No human victim action is needed \u2014 the triggering chmod is performed by automated package-manager activity (unattended-upgrades/dnf-automatic/dpkg unpack) or can be induced by the attacker via PackageKit, while the attacker\u0027s exec loop runs unattended.\nS:U - This is a standard local privilege escalation within the same security authority: an unprivileged user gains root on the same OS instance, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Successful exploitation yields euid 0 in the initial user namespace, granting unrestricted read access to all files, memory, and secrets on the system.\nI:H - Root privileges allow arbitrary modification of any file, kernel configuration, and system state \u2014 a complete loss of integrity, which is precisely the \"unintended privileges\" the commit describes as proven exploitable.\nA:H - With root obtained, the attacker can shut down, panic, or otherwise render the system entirely unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:57.729Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958f"
        },
        {
          "url": "https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121e"
        },
        {
          "url": "https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cb"
        }
      ],
      "title": "exec: Fix ToCToU between perm check and set-uid/gid usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43882",
    "datePublished": "2024-08-21T00:10:49.556Z",
    "dateReserved": "2024-08-17T09:11:59.287Z",
    "dateUpdated": "2026-08-05T11:36:57.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:06:36.516Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-10T04:55:56.573367Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.613Z\"}}], \"cna\": {\"title\": \"exec: Fix ToCToU between perm check and set-uid/gid usage\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"d5c3c7e26275a2d83b894d30f7582a42853a958f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"368f6985d46657b8b466a421dddcacd4051f7ada\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"15469d46ba34559bfe7e3de6659115778c624759\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"9b424c5d4130d56312e2a3be17efb0928fec4d64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"d2a2a4714d80d09b0f8eb6438ab4224690b7121e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9167b0b9a0ab7907191523f5a0528e3b9c288e21\", \"lessThan\": \"f50733b45d865f91db90919f8311e2127ce5a0cb\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/exec.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.106\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.47\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/exec.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d5c3c7e26275a2d83b894d30f7582a42853a958f\"}, {\"url\": \"https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada\"}, {\"url\": \"https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de6659115778c624759\"}, {\"url\": \"https://git.kernel.org/stable/c/9b424c5d4130d56312e2a3be17efb0928fec4d64\"}, {\"url\": \"https://git.kernel.org/stable/c/f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1\"}, {\"url\": \"https://git.kernel.org/stable/c/d2a2a4714d80d09b0f8eb6438ab4224690b7121e\"}, {\"url\": \"https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e\"}, {\"url\": \"https://git.kernel.org/stable/c/f50733b45d865f91db90919f8311e2127ce5a0cb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nexec: Fix ToCToU between perm check and set-uid/gid usage\\n\\nWhen opening a file for exec via do_filp_open(), permission checking is\\ndone against the file\u0027s metadata at that moment, and on success, a file\\npointer is passed back. Much later in the execve() code path, the file\\nmetadata (specifically mode, uid, and gid) is used to determine if/how\\nto set the uid and gid. However, those values may have changed since the\\npermissions check, meaning the execution may gain unintended privileges.\\n\\nFor example, if a file could change permissions from executable and not\\nset-id:\\n\\n---------x 1 root root 16048 Aug  7 13:16 target\\n\\nto set-id and non-executable:\\n\\n---S------ 1 root root 16048 Aug  7 13:16 target\\n\\nit is possible to gain root privileges when execution should have been\\ndisallowed.\\n\\nWhile this race condition is rare in real-world scenarios, it has been\\nobserved (and proven exploitable) when package managers are updating\\nthe setuid bits of installed programs. Such files start with being\\nworld-executable but then are adjusted to be group-exec with a set-uid\\nbit. For example, \\\"chmod o-x,u+s target\\\" makes \\\"target\\\" executable only\\nby uid \\\"root\\\" and gid \\\"cdrom\\\", while also becoming setuid-root:\\n\\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\\n\\nbecomes:\\n\\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\\n\\nBut racing the chmod means users without group \\\"cdrom\\\" membership can\\nget the permission to execute \\\"target\\\" just before the chmod, and when\\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\\nsetuid to root, violating the expressed authorization of \\\"only cdrom\\ngroup members can setuid to root\\\".\\n\\nRe-check that we still have execute permissions in case the metadata\\nhas changed. It would be better to keep a copy from the perm-check time,\\nbut until we can do that refactoring, the least-bad option is to do a\\nfull inode_permission() call (under inode lock). It is understood that\\nthis is safe against dead-locks, but hardly optimal.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.320\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.106\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.47\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.6\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"2.6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:31:39.130Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:31:39.130Z\", \"dateReserved\": \"2024-08-17T09:11:59.287Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T00:10:49.556Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.