Symbolic Link Vulnerability in glog Affected by GoLang

CVE-2024-45339

What is CVE-2024-45339?

A security vulnerability exists in the glog logging library, allowing an unprivileged attacker to exploit the default behavior of writing logs to a widely-writable directory. By predicting the log file path of a privileged process, the attacker can create a symbolic link that redirects log entries to a sensitive file. When the privileged process executes and attempts to write to its log, it inadvertently overwrites the sensitive file, compromising data integrity. To mitigate this issue, recent updates to glog ensure that the program will terminate with an error when it detects that the configured log file already exists.

References