CVE-2018-13405
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member…
Does this matter?
A public exploit is published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 1.0%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.
Description
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.04% probability · 64th percentile
- Public exploits
- 1 in Exploit-DB · verified · first 16 July 2018
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- linux/linux kernel · debian/debian linux · canonical/ubuntu linux · fedoraproject/fedora · redhat/mrg realtime · redhat/virtualization · redhat/enterprise linux aus · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux for real time · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server tus · redhat/enterprise linux workstation · f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip domain name system · +7 more
- Source
- cve@mitre.org
EPSS 1.0% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7Patch, Vendor Advisory
- http://openwall.com/lists/oss-security/2018/07/13/2Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/106503Broken Link
- https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3083Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3096Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0717Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2566Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2696Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2730Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4164Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840cd61c23e2b9241093737b4c395cb406Mailing List, Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/08/msg00014.htmlThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRBNBX73SAFKQWBOX76SLMWPTKJPVGEJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKKIAUMR5FAYLZ7HLEPOXMKAAE3BYBQ/
- https://support.f5.com/csp/article/K00854051Third Party Advisory
- https://twitter.com/grsecurity/status/1015082951204327425Third Party Advisory
- https://usn.ubuntu.com/3752-1/Third Party Advisory
- https://usn.ubuntu.com/3752-2/Third Party Advisory
- https://usn.ubuntu.com/3752-3/Third Party Advisory
- https://usn.ubuntu.com/3753-1/Third Party Advisory
- https://usn.ubuntu.com/3753-2/Third Party Advisory
- https://usn.ubuntu.com/3754-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4266Third Party Advisory
- https://www.exploit-db.com/exploits/45033/Exploit, Third Party Advisory, VDB Entry
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7Patch, Vendor Advisory
- http://openwall.com/lists/oss-security/2018/07/13/2Mailing List, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.