fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | * | 2.6.21.7 (including) |
| Linux_kernel | Linux | 2.2.27 (including) | 2.2.27 (including) |
| Linux_kernel | Linux | 2.4.36 (including) | 2.4.36 (including) |
| Linux_kernel | Linux | 2.4.36.1 (including) | 2.4.36.1 (including) |
| Linux_kernel | Linux | 2.4.36.2 (including) | 2.4.36.2 (including) |
| Linux_kernel | Linux | 2.4.36.3 (including) | 2.4.36.3 (including) |
| Linux_kernel | Linux | 2.4.36.4 (including) | 2.4.36.4 (including) |
| Linux_kernel | Linux | 2.4.36.5 (including) | 2.4.36.5 (including) |
| Linux_kernel | Linux | 2.4.36.6 (including) | 2.4.36.6 (including) |
| Linux_kernel | Linux | 2.6 (including) | 2.6 (including) |
| Linux_kernel | Linux | 2.6.18 (including) | 2.6.18 (including) |
| Linux_kernel | Linux | 2.6.18-rc1 (including) | 2.6.18-rc1 (including) |
| Linux_kernel | Linux | 2.6.18-rc2 (including) | 2.6.18-rc2 (including) |
| Linux_kernel | Linux | 2.6.18-rc3 (including) | 2.6.18-rc3 (including) |
| Linux_kernel | Linux | 2.6.18-rc4 (including) | 2.6.18-rc4 (including) |
| Linux_kernel | Linux | 2.6.18-rc5 (including) | 2.6.18-rc5 (including) |
| Linux_kernel | Linux | 2.6.18-rc6 (including) | 2.6.18-rc6 (including) |
| Linux_kernel | Linux | 2.6.18-rc7 (including) | 2.6.18-rc7 (including) |
| Linux_kernel | Linux | 2.6.19.4 (including) | 2.6.19.4 (including) |
| Linux_kernel | Linux | 2.6.19.5 (including) | 2.6.19.5 (including) |
| Linux_kernel | Linux | 2.6.19.6 (including) | 2.6.19.6 (including) |
| Linux_kernel | Linux | 2.6.19.7 (including) | 2.6.19.7 (including) |
| Linux_kernel | Linux | 2.6.20.16 (including) | 2.6.20.16 (including) |
| Linux_kernel | Linux | 2.6.20.17 (including) | 2.6.20.17 (including) |
| Linux_kernel | Linux | 2.6.20.18 (including) | 2.6.20.18 (including) |
| Linux_kernel | Linux | 2.6.20.19 (including) | 2.6.20.19 (including) |
| Linux_kernel | Linux | 2.6.20.20 (including) | 2.6.20.20 (including) |
| Linux_kernel | Linux | 2.6.20.21 (including) | 2.6.20.21 (including) |
| Linux_kernel | Linux | 2.6.21.5 (including) | 2.6.21.5 (including) |
| Linux_kernel | Linux | 2.6.21.6 (including) | 2.6.21.6 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | kernel-0:2.4.18-e.67 | * |
| Red Hat Enterprise Linux 2.1 | RedHat | kernel-0:2.4.9-e.74 | * |
| Red Hat Enterprise Linux 3 | RedHat | kernel-0:2.4.21-58.EL | * |
| Red Hat Enterprise Linux 4 | RedHat | kernel-0:2.6.9-78.0.8.EL | * |
| Red Hat Enterprise Linux 5 | RedHat | kernel-0:2.6.18-92.1.18.el5 | * |
| Linux | Ubuntu | upstream | * |
| Linux-source-2.6.15 | Ubuntu | dapper | * |
| Linux-source-2.6.15 | Ubuntu | upstream | * |
| Linux-source-2.6.20 | Ubuntu | feisty | * |
| Linux-source-2.6.20 | Ubuntu | upstream | * |