__audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable. This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail. The bug has been present since the original introduction of CAPSET audit records in 2008.
Unified · Split
| @@ -2786,7 +2786,7 @@ void __audit_log_capset(const struct cred *new, const struct cred *old) · 2785 unmodified lines | ||
| 2786 | 2786 | |
| 2787 | 2787 | context->capset.pid = task_tgid_nr(current); |
| 2788 | 2788 | context->capset.cap.effective = new->cap_effective; |
| 2789 | − context->capset.cap.inheritable = new->cap_effective; | |
| 2789 | + context->capset.cap.inheritable = new->cap_inheritable; | |
| 2790 | 2790 | context->capset.cap.permitted = new->cap_permitted; |
| 2791 | 2791 | context->capset.cap.ambient = new->cap_ambient; |
| 2792 | 2792 | context->type = AUDIT_CAPSET; |