CVE-2024-43882: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-43882 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the Linux kernel's execution handling system, discovered in August 2024. The vulnerability affects the permission checking mechanism during file execution, specifically in the way the kernel handles set-uid/gid usage between initial permission checks and actual execution (NVD).

The vulnerability occurs when opening a file for execution via do_filp_open(), where permission checking is done against the file's metadata at that moment. Later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, these values may have changed since the initial permissions check, potentially leading to unintended privilege escalation. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) by NIST and 8.4 (HIGH) by CISA-ADP (NVD).

The vulnerability can allow an attacker to gain root privileges when execution should have been disallowed. This is particularly exploitable when package managers are updating the setuid bits of installed programs, where files transition from being world-executable to having group-exec with set-uid bit permissions (Kernel Patch).

While this race condition is rare in real-world scenarios, it has been proven exploitable in specific circumstances. For example, when a file changes permissions from executable and not set-id (---------x) to set-id and non-executable (---S------), an attacker can potentially gain root privileges by racing the chmod operation (NVD).

The vulnerability has been patched by implementing a re-check of execute permissions in case the metadata has changed. The fix involves performing a full inode_permission() call under inode lock, though this is noted as a temporary solution until better refactoring can be implemented. The patch has been applied to multiple Linux kernel versions (Kernel Patch).