Upstream information

CVE-2015-5228 at MITRE

Description

The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 7.2 6.6
Vector AV:L/AC:L/Au:N/C:C/I:C/A:C AV:L/AC:L/Au:N/C:C/I:C/A:N
Access Vector Local Local
Access Complexity Low Low
Authentication None None
Confidentiality Impact Complete Complete
Integrity Impact Complete Complete
Availability Impact Complete None
CVSS v3 Scores
  National Vulnerability Database
Base Score 7.8
Vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
CVSSv3 Version 3
SUSE Bugzilla entry: 943105 [RESOLVED / FIXED]

SUSE Security Advisories:

    openSUSE-SU-2015:1593-1

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • criu >= 2.9-1.1
  • criu-devel >= 2.9-1.1
  • libcriu1 >= 2.9-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-10278

SUSE Timeline for this CVE

CVE page created: Tue Aug 25 14:15:44 2015
CVE page last modified: Wed Apr 16 17:20:16 2025