Description
The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.13etch6 | DSA-1436-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-13etch6 | DSA-1436-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.13etch6 | DSA-1436-1 |
| Debian 3.1 | fai-kernels | 1.9.1sarge8 | DSA-1504-1 |
| Debian 3.1 | hostap-modules-i386 | 1:0.3.7-1sarge3 | DSA-1503-1 |
| Debian 3.1 | i2c | 1:2.9.1-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-7sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-5sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-6sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-16sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-speakup-i386 | 2.4.27-1.1sarge5 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-alpha | 101sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-i386 | 101sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-s390 | 2.4.27-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-sparc | 42sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge6 | DSA-1503-2, DSA-1503-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-17sarge1 | DSA-1504-1 |
| Debian 3.1 | mindi-kernel | 2.4.27-2sarge5 | DSA-1503-1 |
| Debian 3.1 | pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 | DSA-1503-1 |
| Debian 3.1 | systemimager | 3.2.3-6sarge5 | DSA-1503-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.6.el5 | RHSA-2008:0089 |
| RHEL 4 | kernel +10 | 2.6.9-67.0.4.EL | RHSA-2008:0055 |
| RHEL 3 | kernel +8 | 2.4.21-57.EL | RHSA-2008:0211 |
| RHEL 2 | kernel +8 | 2.4.9-e.74 | RHSA-2009:0001, RHSA-2008:0787 |
Advisories 9
- RHSA-2009:0001 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0089 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0211 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0055 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1503-2 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1503-1 kernelimage-2.4.27 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1504-1 kernel-image-2.6.8 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1436-1 linux-2.6 fai-kernels user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0787 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 20080208 rPSA-2008-0048-1 kernel mailing-list
- 30962 third-party-advisory
- http://bugzilla.kernel.org/show_bug.cgi?id=3043
- 27908 third-party-advisory
- DSA-1436 vendor-advisory
- 28643 third-party-advisory
- SUSE-SA:2008:007 vendor-advisory
- 28141 third-party-advisory
- 28826 third-party-advisory
- 28706 third-party-advisory
- MDVSA-2008:112 vendor-advisory
- DSA-1504 vendor-advisory
- kernel-core-dump-information-disclosure(38841) vdb-entry
- 26701 vdb-entry
- 28889 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0048
- 30110 third-party-advisory
- ADV-2008-2222 vdb-entry
- 33280 third-party-advisory
- MDVSA-2008:086 vendor-advisory
- MDVSA-2008:044 vendor-advisory
- oval:org.mitre.oval:def:10719 vdb-entry signature
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
- DSA-1503 vendor-advisory
- 28748 third-party-advisory
- USN-574-1 vendor-advisory
- ADV-2007-4090 vdb-entry
- 29058 third-party-advisory
- RHSA-2008:0211 vendor-advisory
- 28971 third-party-advisory
- RHSA-2008:0787 vendor-advisory
- RHSA-2008:0089 vendor-advisory
- [Security-announce] 20080728 VMSA-2008-00011 Updated ESX service console packages for Samba and vmnix mailing-list
- SUSE-SA:2008:030 vendor-advisory
- USN-578-1 vendor-advisory
- 31246 third-party-advisory
- RHSA-2008:0055 vendor-advisory
- 30818 third-party-advisory
- SUSE-SA:2008:032 vendor-advisory