Filesystem race on temporary files
CVE-2022-35631

5.5MEDIUM

Key Information:

Vendor

Rapid7

Status
Velociraptor
Vendor
CVE Published:
29 July 2022

What is CVE-2022-35631?

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.

Affected Version(s)

Velociraptor 0.6.5-2

References

https://www.rapid7.com/blog/post/2022/07/26/cve-2022-3562...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
.
CVE-2022-35631 : Filesystem race on temporary files