CVE-2017-5551: linux linux_kernel
Vulnerability summary
CVE-2017-5551 is a medium (CVSS 4.4) vulnerability in linux linux_kernel. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 20 · Related 12Timeline
- 06-02-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu12 products
- linux< 4.4.0-67.88
- linux-aws< 4.4.0-1009.18
- linux-azure-fdeAll versions (No fix recorded)
- linux-gkeAll versions (No fix recorded)
- linux-hwe< 4.10.0-32.36~16.04.1
Debian1 product
- linux< 4.9.6-1
Linux1 product
- linux_kernel≤ 4.9.5
3 vendors · 14 products
References
16 links- www.openwall.com/lists/oss-security/2017/01/21/3Mailing ListX Refsource MLISTPatchThird Party Advisory
- github.com/torvalds/linux/commit/497de07d89c1410d76a15bec2bb41f24a2a89f31X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
