| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| chainguard.dev/apko | ≥ 0.27.0, < 0.29.5 | 0.29.5 |
It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666:
bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache
This issue was introduced in commit 04f37e2 ("generate /etc/ld.so.cache (#1629)")(v0.27.0).
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
This issue was addressed in apko in aedb077 ("fix: /etc/ld.so.cache file permissions (#1758)") (v0.29.5).
Many thanks to Cody Harris from H2O.ai for reporting this issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí