CVE-2023-30571
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published May 29, 2023
Updated: Jan 14, 2025
CWE ID 362
Summary
CVE-2023-30571 is a vulnerability in Libarchive versions up to 3.6.2. This issue allows directories to have world-writable permissions due to a race condition. During archive creation, the umask() call in archive_write_disk_posix.c briefly changes the process's umask to 0, making it possible for another thread to set the umask permanently to 0777. This can lead to implicit directory creation with dangerous permissions, enabling low-privileged local users to delete and rename files within those directories.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Libarchive
Affected Vendors
- Libarchive