Back to Database
Status published
Medium
CVE-2008-1940
The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does...
Vulnerability Description
The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-1940
Credits & Attribution
No credits recorded in the NVD database.
References
More from grsecurity
View All →CVE-2010-3373
paxtest handles temporary files insecurely...
Medium
5.5
CVE-2007-0257
Unspecified vulnerability in the expand_stack function in grsecurity PaX allows...
Unknown
0
CVE-2007-0253
Unspecified vulnerability in the grsecurity patch has unspecified impact and...
High
7.2
CVE-2006-0228
The RBAC functionality in grsecurity before 2.1.8 does not properly...
High
7.2
CVE-2002-1826
grsecurity 1.9.4 for Linux kernel 2.4.18 allows local users to...
Medium
4.6
Affected Vendor
grsecurity
View all reports →Affected Software
grsecurity kernel patch
Vulnerable Versions:
2.4.33, 2.4.33.2, 2.4.33.3, 2.4.33.4, 2.4.34, 2.6.18, 2.6.24.4
Timeline
Official Publish:
April 24th, 2008
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.