Local Privilege Escalation in Gentoo GIMPS Package by Unsafe Command Execution
CVE-2017-14484

7.3HIGH

Key Information:

Vendor

Gentoo

Status
Sci-mathematics-gimps
Vendor
CVE Published:
15 September 2017

What is CVE-2017-14484?

The Gentoo GIMPS package prior to version 28.10-r1 contains a vulnerability that enables local users to gain elevated privileges. This occurs due to the execution of an unsafe 'chown -R' command, which can be exploited by creating a hard link under the /var/lib/gimps directory. This oversight allows unauthorized users to manipulate file permissions, posing a significant security risk within the system.

References

https://bugs.gentoo.org/show_bug.cgi?id=603408
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.