CVE Vulnerabilities

CVE-2008-1940

Published: Apr 25, 2008 | Modified: Aug 08, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.

Affected Software

Name Vendor Start Version End Version
Grsecurity_kernel_patch Grsecurity 2.4.33.2 2.4.33.2
Grsecurity_kernel_patch Grsecurity 2.6.18 2.6.18
Grsecurity_kernel_patch Grsecurity 2.4.33.4 2.4.33.4
Grsecurity_kernel_patch Grsecurity 2.4.33 2.4.33
Grsecurity_kernel_patch Grsecurity 2.4.33.3 2.4.33.3
Grsecurity_kernel_patch Grsecurity 2.6.24.4 2.6.24.4
Grsecurity_kernel_patch Grsecurity 2.4.34 2.4.34

References