CVE-2007-3740

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-14 · updated 2026-06-16
Weakness: CWE-264

Description

The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.

Affected products

Linux kernel: through 2.6.21.7; 2.2.27, 2.4.36, 2.4.36.1, 2.4.36.2, 2.4.36.3, 2.4.36.4 (+23)

References

http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html
http://secunia.com/advisories/26760
http://secunia.com/advisories/26955
http://secunia.com/advisories/26978
http://secunia.com/advisories/27436
http://secunia.com/advisories/27747
http://secunia.com/advisories/27912
http://secunia.com/advisories/28806
http://secunia.com/advisories/29058
http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm
http://www.debian.org/security/2007/dsa-1378

Get alerted when CVE-2007-3740 or the next vulnerability affects your stack