CVE-2016-7097

What it actually does

The Linux kernel filesystem code preserves the setgid bit when setxattr is invoked on a file, allowing a local process to retain group-execute privileges on a setgid binary even when the binary's execute permission has been restricted.

Why it matters to the business

Attackers who already have a local shell on an affected Linux system can obtain the privileges of the group that owns a setgid program, potentially exposing sensitive group-owned data or resources and bypassing intended access controls.

How an attack unfolds

An attacker with a local account locates a setgid program whose execute bit has been removed for non-owners, then calls setxattr on that file so the kernel keeps the setgid bit set; subsequent execution of the program runs with the target group's privileges.

How to fix it

Upgrade the Linux kernel to the commit 073931017b49d9458aa351605b43a7e34598caef or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit 073931017b49d9458aa351605b43a7e34598caef (or a back-port) by inspecting /proc/version or the kernel build log; confirm setgid bit behavior with a test binary before and after the update.

Typical attack path

1. Obtain a local shell on the target Linux system
2. Identify setgid binaries that have restricted execute permissions
3. Invoke setxattr on the chosen binary to preserve the setgid bit
4. Execute the binary to inherit the owning group's privileges

How to detect it

Review system call audit logs for setxattr operations performed by unprivileged users on files that carry the setgid bit; correlate with subsequent executions of those files under unexpected group contexts.

What your security team should do

• Apply the kernel patch or upgrade to a fixed distribution kernel immediately on all affected hosts
• Audit setgid binaries and remove unnecessary setgid permissions where possible
• Monitor for local privilege-escalation attempts using existing endpoint detection tooling