Race condition in Zstandard - #VU50841
Published: February 22, 2021 / Updated: March 4, 2021
Vulnerability identifier: #VU50841
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition when creating files. The application creates a files with the default umask before chmod'ing to down to 0600. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
Affected software
Zstandard
libzstd (Debian package)
libzstd (Debian package)
Remediation
Install update from vendor's website.
Zstandard - update to 1.4.9
libzstd (Debian package) - update to 1.3.8+dfsg-3+deb10u2
libzstd (Debian package) - update to 1.3.8+dfsg-3+deb10u2