Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue

[Christian Göttsche <cgoettsche () seltendoof de>]

Apr 7, 2026 18:54:22 Andrew G. Morgan <morgan () kernel org>:

> Hi,
>
> I've just released libcap-2.78 which includes a fix for a TOCTOU issue
> in libcap.
>
> The issue has been allocated the following code: CVE-2026-4878. It is
> the subject of this private bug:
> https://bugzilla.redhat.com/show_bug.cgi?id=2447554 and is also
> written up in a github.com advisory which I will publish on Wednesday
> (this week). The github advisory tool characterizes the issue as
> CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (Severity: Moderate 7 /
> 10).
>
> The fix for pretty much that whole range of libcap releases is this commit:
>
> https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596

Hi,

the new code suppports changing the file capabilities of all kinds of files (not just regular)(given that the caller 
has read permissions).
Is that intended?

Best regards,
       Christian Göttsche


> As the code is publicly available, there is no embargo in place for
> releasing fixes.
>
> Cheers
>
> Andrew
>
> PS I tried a few times to post to the private openwall list about this
> issue 9 days ago, but my email bounced (likely because I couldn't
> effectively follow the mail formatting requirements). I might have
> realized that the emails were bounced if gmail hadn't silently placed
> the bounced replies in my SPAM folder. Sorry about that.