CVE-2021-24031

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404	Exploit Issue Tracking Mailing List Third Party Advisory
https://github.com/facebook/zstd/issues/1630	Exploit Issue Tracking Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24031	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-04 21:15

Updated : 2021-04-14 15:28

NVD link : CVE-2021-24031

Mitre link : CVE-2021-24031

CVE.ORG link : CVE-2021-24031

JSON object : View

Products Affected

facebook

zstandard

CWE

CWE-276

Incorrect Default Permissions

CWE-277

Insecure Inherited Permissions

{"id": "CVE-2021-24031", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-03-04T21:15:12.743", "references": [{"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404", "tags": ["Exploit", "Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://github.com/facebook/zstd/issues/1630", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://www.facebook.com/security/advisories/cve-2021-24031", "tags": ["Vendor Advisory"], "source": "cve-assign@fb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-277"}]}], "descriptions": [{"lang": "en", "value": "In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties."}, {"lang": "es", "value": "En la utilidad Zstandard command-line versiones anteriores a v1.4.1, los archivos de salida se creaban con permisos predeterminados. Los permisos de archivo correctos (que coincidan con la entrada) solo se establecer\u00e1n en el momento de la completaci\u00f3n. Por lo tanto, los archivos de salida podr\u00edan ser le\u00eddos o escribibles para personas no deseadas"}], "lastModified": "2021-04-14T15:28:44.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BB54F72-0467-43BC-B73A-DA6DC8A55FD9", "versionEndExcluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}