Upstream information

CVE-2015-5228 at MITRE

Description

The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.

SUSE information

Overall state of this security issue: Ignore

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 7.2 6.6
Vector AV:L/AC:L/Au:N/C:C/I:C/A:C AV:L/AC:L/Au:N/C:C/I:C/A:N
Access Vector Local Local
Access Complexity Low Low
Authentication None None
Confidentiality Impact Complete Complete
Integrity Impact Complete Complete
Availability Impact Complete None
SUSE Bugzilla entry: 943105 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • criu >= 2.9-1.1
  • criu-devel >= 2.9-1.1
  • libcriu1 >= 2.9-1.1
 Patchnames:
openSUSE Tumbleweed GA criu