Risk | Low |
Patch available | YES |
Number of vulnerabilities | 4 |
CVE-ID | CVE-2018-13405 CVE-2021-4037 CVE-2022-42703 CVE-2022-4378 |
CWE-ID | CWE-264 CWE-284 CWE-416 CWE-121 |
Exploitation vector | Local |
Public exploit |
Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #4 is available. |
Vulnerable software Subscribe |
CentOS Operating systems & Components / Operating system |
Vendor | CentOS Project |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
EUVDB-ID: #VU13631
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2018-13405
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local attacker to create arbitrary files on the target system.
The vulnerability exists due to the inode_init_owner function, as defined in the fs/inode.c source code file, allows the creation of arbitrary files in set-group identification (SGID) directories. A local attacker can create arbitrary files with unintended group ownership.
MitigationUpdate the affected packages.
Vulnerable software versionsCentOS: 7
Fixed software versionsCPE2.3 External links
http://lists.centos.org/pipermail/centos-announce/2023-March/086390.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU63923
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2021-4037
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the fs/inode.c:inode_init_owner() function logic of the Linux kernel. A local user can create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set to bypass implemented security restrictions and gain unauthorized access to the application.
MitigationUpdate the affected packages.
Vulnerable software versionsCentOS: 7
Fixed software versionsCPE2.3 External links
http://lists.centos.org/pipermail/centos-announce/2023-March/086390.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU69297
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-42703
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the mm/rmap.c in the Linux kernel, related to leaf anon_vma double reuse. A local user can trigger a use-after-free error and crash the kernel.
Update the affected packages.
Vulnerable software versionsCentOS: 7
Fixed software versionsCPE2.3 External links
http://lists.centos.org/pipermail/centos-announce/2023-March/086390.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU70442
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-4378
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the __do_proc_dointvec() function. A local user can trigger a stack-based buffer overflow and execute arbitrary code with elevated privileges.
Update the affected packages.
Vulnerable software versionsCentOS: 7
Fixed software versionsCPE2.3 External links
http://lists.centos.org/pipermail/centos-announce/2023-March/086390.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?