CVE-2017-18018 In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify t...
MediumCVSS 4.7
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/coreutils(Debian:12) | All versions | No fix listed |
| debian/coreutils(Debian:12) | = 9.1-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.10-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.4-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.4-2 | No fix listed |
| debian/coreutils(Debian:12) | = 9.4-3 | No fix listed |
| debian/coreutils(Debian:12) | = 9.4-3.1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.5-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.6-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.6-2 | No fix listed |
| debian/coreutils(Debian:12) | = 9.7-1 | No fix listed |
| debian/coreutils(Debian:12) | = 9.7-2 | No fix listed |
| debian/coreutils(Debian:12) | = 9.7-3 | No fix listed |
| debian/coreutils(Debian:13) | All versions | No fix listed |
| debian/coreutils(Debian:13) | = 9.10-1 | No fix listed |
| debian/coreutils(Debian:13) | = 9.7-3 | No fix listed |
| debian/coreutils(Debian:14) | All versions | No fix listed |
| debian/coreutils(Debian:14) | = 9.10-1 | No fix listed |
| debian/coreutils(Debian:14) | = 9.7-3 | No fix listed |
| GNU coreutils | <= 8.29 | No fix listed |
| alpine/coreutils(Alpine:v3.10) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.11) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.12) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.13) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.14) | < 8.30-r0 | 8.30-r0 |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/coreutils(Alpine:v3.15) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.16) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.17) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.18) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.19) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.20) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.21) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.22) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.23) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.24) | < 8.30-r0 | 8.30-r0 |
| alpine/coreutils(Alpine:v3.7) | < 8.28-r0 | 8.28-r0 |
| alpine/coreutils(Alpine:v3.8) | < 8.29-r2 | 8.29-r2 |
| alpine/coreutils(Alpine:v3.9) | < 8.30-r0 | 8.30-r0 |
References
- Debian Security Tracker CVE-2017-18018 vendor-advisory
- lists.gnu.org exploit issue-tracking third-party-advisory
- security.alpinelinux.org vendor-advisory