Upstream information

CVE-2015-5228 at MITRE

Description

The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 7.2 6.6
Vector AV:L/AC:L/Au:N/C:C/I:C/A:C AV:L/AC:L/Au:N/C:C/I:C/A:N
Access Vector Local Local
Access Complexity Low Low
Authentication None None
Confidentiality Impact Complete Complete
Integrity Impact Complete Complete
Availability Impact Complete None
SUSE Bugzilla entry: 943105 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • criu >= 2.9-1.1
  • criu-devel >= 2.9-1.1
  • libcriu1 >= 2.9-1.1
 Patchnames:
openSUSE Tumbleweed GA criu-2.9-1.1

SUSE Timeline for this CVE

CVE page created: Tue Aug 25 14:15:44 2015
CVE page last modified: Fri Oct 7 12:47:14 2022