CVE-2021-3864: linux-libc-dev - kernel: descendant's dumpable setting with certain SUID binaries
Summary
CVE-2021-3864: A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in Debian that provides the C library development files for the Linux kernel. It is used by developers to compile and build applications that interact with the kernel. This package is essential for creating and linking programs that require system calls and other low-level operations. However, a vulnerability has been discovered in linux-libc-dev that affects the dumpable flag setting when certain SUID binaries execute their descendants.
Vulnerability Detail
The vulnerability arises when a SUID binary sets the real UID equal to the effective UID and the real GID equal to the effective GID. In such cases, the descendant process inherits a dumpable value of 1. If the descendant process crashes and the core_pattern is set to a relative value, the core dump is stored in the current directory with uid:gid permissions. This allows an unprivileged local user with access to an eligible root SUID binary to place core dumps into root-owned directories, potentially leading to privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can modify the core_pattern configuration to use an absolute path for storing core dumps. This can be done by editing the /proc/sys/kernel/core_pattern file and specifying an absolute path. For example, you can set it to '/var/core/core-%e-%p-%t'. This ensures that core dumps are stored in a specific directory with the desired permissions, mitigating the risk of privilege escalation.
Conclusion
The vulnerability in linux-libc-dev can potentially lead to privilege escalation if exploited by an unprivileged local user. It is crucial to update the package to a patched version and apply any recommended fixes or workarounds. Regularly monitoring for updates and maintaining good security practices is essential for protecting your system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in Debian that provides the C library development files for the Linux kernel. It is used by developers to compile and build applications that interact with the kernel.
SUID (Set User ID) is a permission that allows a user to execute a file with the permissions of the file owner. SUID binaries are often used to perform privileged operations while being executed by non-privileged users.
The vulnerability allows an unprivileged local user with access to an eligible root SUID binary to place core dumps into root-owned directories. This can potentially lead to privilege escalation and compromise the security of the system.
The recommended fix is to update the linux-libc-dev package to a version that includes the necessary patches. Regularly checking for updates and applying them promptly is crucial for maintaining the security of your system.
Yes, a workaround is to modify the core_pattern configuration to use an absolute path for storing core dumps. This can be done by editing the /proc/sys/kernel/core_pattern file and specifying an absolute path.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
