VULNERABILITY INTELLIGENCE

CVE-2016-7097

CVSS score4.4 MEDIUM
EPSS probability0.39%
CISA KEVNot currently listed
Published2016-10-16
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.

Weakness classification

  • CWE-285: Improper Authorization

Primary references