CVE-2024-45339: Vulnerability when creating log files in github.com/golang/glog
Vulnerability when creating log files in github.com/golang/glog
Other sources
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/golang/glogto a version that resolves this vulnerability.Fixed in 1.2.4 - Configuration
Update to the glog behavior where, if the configured log file already exists, glog exits with status code 2 to prevent symlink/hardlink log file pre-creation attacks.
github.com/golang/glog log file creation behavior = exit with status code 2 when configured log file already exists
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45339?
CVE-2024-45339 has been classified as a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-45339?
To fix CVE-2024-45339, ensure that logs are written to a secure directory that is not widely writable by unprivileged users.
What are the potential impacts of CVE-2024-45339?
The potential impacts of CVE-2024-45339 include unauthorized access to sensitive files and potential complete system compromise.
Which software versions are affected by CVE-2024-45339?
CVE-2024-45339 affects versions prior to 1.2.4 of the Go package github.com/golang/glog.
Who is the vendor associated with CVE-2024-45339?
The vendor associated with CVE-2024-45339 is Google, which maintains the glog package.