CVE search · CVE-2020-36770
CVE-2020-36770
critical 9.8
pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- NVD-CWE-noinfo, CWE-732
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | high 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- gentoo · ebuild_for_slurm
References
- https://bugs.gentoo.org/631552ExploitIssue TrackingPatch
- https://bugs.gentoo.org/631552ExploitIssue TrackingPatch