Commit 257b5358b32f ("scm: Capture the full credentials of the scm sender") changed the credentials passing code to pass in the effective uid/gid instead of the real uid/gid.
Obviously this doesn't matter most of the time (since normally they are the same), but it results in differences for suid binaries when the wrong uid/gid ends up being used.
An unprivileged local user could use this flaw to elevate their privileges.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=83f1b4ba917db5dc5a061a44b3403ddb6e783494
Acknowledgements:
Red Hat would like to thank Andy Lutomirski for reporting this issue.
Statement:
This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6.
This issue was addressed in Red Hat Enterprise MRG 2 via RHSA-2013:0829 https://rhn.redhat.com/errata/RHSA-2013-0829.html
Commit 257b5358b32f ("scm: Capture the full credentials of the scm sender") changed the credentials passing code to pass in the effective uid/gid instead of the real uid/gid. Obviously this doesn't matter most of the time (since normally they are the same), but it results in differences for suid binaries when the wrong uid/gid ends up being used. An unprivileged local user could use this flaw to elevate their privileges. Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=83f1b4ba917db5dc5a061a44b3403ddb6e783494 Acknowledgements: Red Hat would like to thank Andy Lutomirski for reporting this issue.