Gradle vulnerable to local privilege escalation through system temporary directory
概要
Gradle vulnerable to local privilege escalation through system temporary directory
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.
In net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the Native.get(Class<>) method was called, without calling Native.init(File) first, with a non-null argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.
Gradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relyi…
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Ubuntu UBUNTU-CVE-2025-27148 gradle
参照URL
- advisory github.com
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web en.wikipedia.org
- web en.wikipedia.org
- web github.com