A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-plugin-fapolicydUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-plugin-selinuxUpgrade rpm-cronUpgrade rpm-plugin-imaUpgrade rpm-apidocsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-syslogUpgrade rpmUpgrade rpm-build-libsUpgrade rpm-sign-libsUpgrade rpm-buildUpgrade rpm-plugin-auditUpgrade rpm-devel | Jan 29, 2024 | Aug 25, 2022 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Aug 25, 2022 |
| Amazon_linux_2023 | — | Upgrade rpm-build-libs-debuginfoUpgrade rpm-debugsourceUpgrade rpm-build-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-devel-debuginfoUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-signUpgrade rpm-sign-libsUpgrade rpm-cronUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-build-libsUpgrade rpm-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-develUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade rpm-plugin-auditUpgrade rpmUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-fapolicydUpgrade python3-rpm-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-ima-debuginfoUpgrade python3-rpmUpgrade rpm-plugin-audit-debuginfo | Feb 17, 2025 | Jun 30, 2021 |
| Centos_linux | — | Upgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-debugsourceUpgrade python3-rpmUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-signUpgrade rpm-build-debuginfoUpgrade rpmUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-libsUpgrade rpm-sign-libs-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-imaUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-fapolicydUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-buildUpgrade rpm-sign-debuginfoUpgrade rpm-develUpgrade rpm-sign-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-cronUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-debuginfo | Jan 26, 2024 | Aug 25, 2022 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Aug 25, 2022 |
| Freebsd | — | Upgrade rpm4 | Dec 2, 2022 | Dec 1, 2022 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 31, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade python3-rpm | Dec 22, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpmUpgrade python3-rpm | Nov 15, 2022 | Aug 25, 2022 |
| Oracle_linux | — | Upgrade rpm-cronUpgrade rpm-develUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-imaUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-buildUpgrade rpm-sign-libsUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpm-signUpgrade python3-rpmUpgrade rpmUpgrade rpm-build-libsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-auditUpgrade rpm-plugin-systemd-inhibit | Jan 25, 2024 | Jun 30, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operator | Aug 10, 2026 | Jun 30, 2021 |
| Redhat_linux | — | Upgrade rpm-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-cronUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debugsourceUpgrade rpm-signUpgrade rpm-build-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-fapolicydUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade python3-rpmUpgrade rpmUpgrade rpm-libs-debuginfoNo solution existsUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-plugin-selinuxUpgrade rpm-sign-libs-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-build-libsUpgrade rpm-sign-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-libsUpgrade python3-rpm-debuginfoUpgrade rpm-develUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-buildUpgrade rpm-apidocs | Jan 26, 2024 | Aug 25, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub