CVE-2017-5551

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3791
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/21/3Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95717Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038053
https://bugzilla.redhat.com/show_bug.cgi?id=1416126Issue Tracking, Patch
https://github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31Issue Tracking, Patch, Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=497de07d89c1410d76a15bec2bb41f24a2a89f31Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3791
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/21/3Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95717Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038053
https://bugzilla.redhat.com/show_bug.cgi?id=1416126Issue Tracking, Patch
https://github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Feb 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-55526.5Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS u CVE-2017-55535.4Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authentic CVE-2017-55548.1An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which CVE-2017-55568.1The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attac CVE-2017-55638.8LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image CVE-2017-55656.7Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), and Antivirus+ Securi CVE-2017-55666.7Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and CVE-2017-55676.7Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), an CVE-2017-55699.8An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be e CVE-2017-55708.8An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can o CVE-2017-55716.1Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in CVE-2017-55726.5An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the h