Back to feed
EUVD-2017-2247 · Published Jul 11, 2017
ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories.
Technologies
Canonical Ubuntu-Image
Weaknesses
CWE-384
CVSS scores
- v3.05.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - v2.04.6
AV:L/AC:L/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Privilege Escalation
References
Potentially impacted assets
See if this affects your attack surface
