Vulnerability Details CVE-2022-1348
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 27.0%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://www.openwall.com/lists/oss-security/2022/05/25/3
- http://www.openwall.com/lists/oss-security/2022/05/25/4
- http://www.openwall.com/lists/oss-security/2022/05/25/5
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-1348
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7EHGYRE6DSFSBXQIWYDGTSXKO6IFSJQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYEB4F37BY6GLEJKP2EPVAVQ6TA3HQKR/
- http://www.openwall.com/lists/oss-security/2022/05/25/3
- http://www.openwall.com/lists/oss-security/2022/05/25/4
- http://www.openwall.com/lists/oss-security/2022/05/25/5
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-1348
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7EHGYRE6DSFSBXQIWYDGTSXKO6IFSJQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYEB4F37BY6GLEJKP2EPVAVQ6TA3HQKR/
Products affected by CVE-2022-1348
-
cpe:2.3:a:logrotate_project:logrotate:*
-
cpe:2.3:o:fedoraproject:fedora:35
-
cpe:2.3:o:fedoraproject:fedora:36