CVE-2015-5228 The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory...
HighCVSS 7.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/criu(Debian:12) | < 1.8-2 | 1.8-2 |
| debian/criu(Debian:13) | < 1.8-2 | 1.8-2 |
| debian/criu(Debian:14) | < 1.8-2 | 1.8-2 |
| opensuse | = 13.2 | No fix listed |
| criu checkpointrestore in userspace | All versions | No fix listed |
References
- Debian Security Tracker CVE-2015-5228 vendor-advisory
- openSUSE-SU-2015:1593 vendor-advisory
- [oss-security] 20150825 CVE-2015-5228 & CVE-2015-5231 in the criu service daemon mailing-list
- bugzilla.redhat.com
- [CRIU] 20150825 Hardening the criu service daemon mailing-list vendor-advisory
- bugs.debian.org issue-tracking