CWE Code: 362
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Summary: the btrfs implementation in the linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended acl settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2015-05-27
Last Modified Date: 2016-12-31