CVE-2021-4037

What it actually does

The inode_init_owner() function in fs/inode.c fails to correctly handle group ownership inheritance for the XFS filesystem when a directory is SGID and writable by a non-member user, allowing creation of files that inherit the directory's group and receive both group-execute and SGID permission bits.

Why it matters to the business

Local attackers on Linux systems using XFS can obtain unintended group-level access and elevated execution rights on newly created files, increasing the chance of unauthorized data access or further privilege escalation within the affected host.

How an attack unfolds

An attacker with a local account identifies or creates an SGID directory on an XFS filesystem that is writable by a non-group member, then triggers file creation through normal operations; the flawed inode initialization logic grants the directory's group ownership plus SGID and group-execute bits, resulting in files that can be executed with the elevated group context.

How to fix it

Upgrade the Linux kernel to the commit 01ea173e103e or later; rebuild and reboot with the patched kernel image. Where immediate patching is not possible, restrict creation of SGID directories on XFS filesystems and enforce stricter group membership controls.

How to confirm the fix worked

Confirm the running kernel contains commit 01ea173e103e or a later equivalent; test file creation inside an SGID XFS directory from a non-member account and verify that group ownership and SGID bits are no longer incorrectly inherited.

Typical attack path

1. Locate or create an SGID directory on XFS that is writable by a non-member user
2. Perform file creation or copy operations inside that directory
3. Observe resulting files that inherit the directory group and receive SGID plus group-execute bits
4. Leverage the elevated group context for further access or execution

How to detect it

Search system logs and file-creation events for new files on XFS volumes that unexpectedly carry the SGID bit or inherit a group not matching the creating user's primary group; review auditd or fanotify records around inode creation in SGID directories.

What your security team should do

• Apply the kernel fix containing commit 01ea173e103e across all XFS-using systems
• Audit existing XFS filesystems for unexpected SGID directories and files
• Restrict local user ability to create SGID directories until patches are deployed
• Monitor kernel update channels for backports to supported distribution kernels