Su Exec
Monthly
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.