CWE Code: 362
Vulnerability Type: privilege_escalation
CVSS Score: 4.4
CWE Name:  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Summary: debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-02-04
Last Modified Date: 2019-07-29