CVE-2015-3339

What it actually does

Race condition in prepare_binprm allows a local process to execute a setuid binary after ownership has been changed to root but before the setuid bit is cleared, resulting in privilege escalation to root.

Why it matters to the business

Attackers with local access can obtain full system control on unpatched kernels, enabling data theft, persistence, or further lateral movement; the issue is historical with very low current exploitation likelihood.

How an attack unfolds

An attacker with local access monitors or triggers a chown-to-root operation on a setuid-capable binary, then races an execution of that binary in the window where ownership is root but the setuid bit remains, causing the kernel to grant elevated privileges.

How to fix it

Upgrade the Linux kernel to version 3.19.6 or later; apply vendor backports where available for supported distributions and reboot to load the fixed kernel.

How to confirm the fix worked

Verify running kernel version is at least 3.19.6; confirm absence of the vulnerable prepare_binprm race logic via source review or vendor security advisories; test that setuid binaries cannot be raced to root ownership.

Typical attack path

1. Obtain local shell access on target system
2. Identify or create a setuid-eligible binary and trigger concurrent chown-to-root
3. Time execution of the binary during the ownership transition window
4. Receive root privileges and perform post-exploitation actions

How to detect it

Review authentication and process execution logs for unexpected root transitions on setuid binaries around the time of chown activity; examine auditd or kernel audit records for unusual setuid execution patterns.

What your security team should do

• Prioritize kernel upgrades on all systems still running kernels before 3.19.6
• Harden setuid binary usage and minimize local untrusted accounts
• Monitor for new local privilege-escalation attempts even on older kernels