CVE-2016-5746 libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by rea...

MediumCVSS 5.1 EPSS 0.50%

Published: 2016-09-26 18:00
Updated: 2026-06-17 03:49
Exploit status: No public exploit known

Description

libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

Affected products

Product	Affected versions	Fixed in
openSUSE libstorage	All versions	No fix listed
openSUSE libstorage-ng	All versions	No fix listed
yast-storage	All versions	No fix listed
openSUSE leap	= 42.1	No fix listed

References

CVSS v3.0

5.1 Medium

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (2)

v3.0 5.1 · nvd@nist.gov
v2.0 1.2 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.50% (percentile 43.3)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.