Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.
The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.
According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a patch was made available last week.
“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS v...