Sign In

CVE-2017-18018

ADVISORY - nist

Summary

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

EPSS Score⁠: 0.00057 (0.180)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-362⁠

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

ADVISORY - redhat

CWE-362⁠

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Impacted images

Advisories

NIST

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

1.8

EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CWE-362⁠

CVSS SCORE

7.1high

Alpine

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY

Debian

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Ubuntu

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

1.0

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

4.7low

Red Hat

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

0.8

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-362⁠

CVSS SCORE

4.2medium

intheWild

CREATED

UPDATED

ADVISORY IDCVE-2017-18018⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY