CVE-2015-0794 modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.
LowCVSS 3.6
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dracut project dracut | < 037-17.30.1 | 037-17.30.1 |
References
- [opensuse-bugs] 20150619 [Bug 935338] dracut uses hardcoded /tmp/dracut_block_uuid.map filename - symlink attack mailing-list
- [opensuse-bugs] 20150619 [Bug 935338] VUL-0: CVE-2015-0794: dracut: uses hardcoded /tmp/dracut_block_uuid.map filename - symlink attack mailing-list
- openSUSE-SU-2015:2022 vendor-advisory
- Debian Security Tracker CVE-2015-0794 vendor-advisory