Description
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kexec-tools +2 | 2.0.7-19.ael7b_1.2 | RHSA-2015:0986 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kexec-tools +2 | 2.0.7-19.0.1.el7_1.2 | ELSA-2015-0986 |
Advisories 2
- RHSA-2015:0986 Red Hat Security Advisory: kexec-tools security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2015-0986 Moderate: kexec-tools security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 12, 2015
References
- 74622 vdb-entry
- RHSA-2015:0986 vendor-advisory