CVE-2021-4037

NameCVE-2021-4037
DescriptionA vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3173-1, DSA-5257-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bullseye (security), bullseye5.10.218-1fixed
bookworm6.1.94-1fixed
bookworm (security)6.1.90-1fixed
sid, trixie6.9.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebullseye5.10.149-1DSA-5257-1
linuxsource(unstable)5.14.6-1
linux-5.10sourcebuster5.10.149-2~deb10u1DLA-3173-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2027239
https://git.kernel.org/linus/01ea173e103edd5ec41acec65b9261b87e123fc2 (5.12-rc1)

Search for package or bug name: Reporting problems