| Package | Affected versions | Patched versions |
|---|---|---|
| chainguard.dev/apko | ≥ 0.27.0, < 0.29.5 | 0.29.5 |
It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666:
bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache
This issue was introduced in commit 04f37e2 ("generate /etc/ld.so.cache (#1629)")(v0.27.0).
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
This issue was addressed in apko in aedb077 ("fix: /etc/ld.so.cache file permissions (#1758)") (v0.29.5).
Many thanks to Cody Harris from H2O.ai for reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free