146 lines
5.9 KiB
JSON
146 lines
5.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.1",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-32438",
|
|
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "GitHub_M",
|
|
"dateReserved": "2025-04-08T10:54:58.368Z",
|
|
"datePublished": "2025-04-15T19:57:04.668Z",
|
|
"dateUpdated": "2025-04-15T20:08:58.816Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "Local privilege escalation in make-initrd-ng",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-378",
|
|
"lang": "en",
|
|
"description": "CWE-378: Creation of Temporary File With Insecure Permissions",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-379",
|
|
"lang": "en",
|
|
"description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "LOCAL",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"version": "3.1"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"name": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4",
|
|
"tags": [
|
|
"x_refsource_CONFIRM"
|
|
],
|
|
"url": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4"
|
|
},
|
|
{
|
|
"name": "https://github.com/NixOS/nixpkgs/commit/b17590193d8e5697000c23c66afcf11e1753734d",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/NixOS/nixpkgs/commit/b17590193d8e5697000c23c66afcf11e1753734d"
|
|
},
|
|
{
|
|
"name": "https://github.com/NixOS/nixpkgs/commit/fbf76bf72b161b9f4ab97704a8258776d5f3ffba",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/NixOS/nixpkgs/commit/fbf76bf72b161b9f4ab97704a8258776d5f3ffba"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "NixOS",
|
|
"product": "nixpkgs",
|
|
"versions": [
|
|
{
|
|
"version": "< b17590193d8e5697000c23c66afcf11e1753734d",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "< fbf76bf72b161b9f4ab97704a8258776d5f3ffba",
|
|
"status": "affected"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"shortName": "GitHub_M",
|
|
"dateUpdated": "2025-04-15T19:57:04.668Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;."
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "GHSA-m7pq-h9p4-8rr4",
|
|
"discovery": "UNKNOWN"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2025-04-15T20:08:46.640080Z",
|
|
"id": "CVE-2025-32438",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-04-15T20:08:58.816Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |