CVE-2021-24032

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

CVSS v3 4.7 MEDIUM
CVSS v2.0 1.9 LOW

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519	Patch Third Party Advisory
https://github.com/facebook/zstd/issues/2491	Issue Tracking Patch Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24032	Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519	Patch Third Party Advisory
https://github.com/facebook/zstd/issues/2491	Issue Tracking Patch Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24032	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-04 21:15

Updated : 2024-11-21 05:52

NVD link : CVE-2021-24032

Mitre link : CVE-2021-24032

CVE.ORG link : CVE-2021-24032

JSON object : View

Products Affected

facebook

zstandard

CWE

CWE-277

Insecure Inherited Permissions

CWE-276

Incorrect Default Permissions

{"id": "CVE-2021-24032", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2021-03-04T21:15:12.963", "references": [{"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519", "tags": ["Patch", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://github.com/facebook/zstd/issues/2491", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://www.facebook.com/security/advisories/cve-2021-24032", "tags": ["Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/facebook/zstd/issues/2491", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.facebook.com/security/advisories/cve-2021-24032", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-277"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties."}, {"lang": "es", "value": "A partir de la versi\u00f3n v1.4.1 y anterior a la v1.4.9, debido a una soluci\u00f3n incompleta para el CVE-2021-24031, la utilidad de l\u00ednea de comandos Zstandard cre\u00f3 archivos de salida con permisos predeterminados y restringi\u00f3 esos permisos inmediatamente despu\u00e9s. Por lo tanto, los archivos de salida podr\u00edan ser moment\u00e1neamente legibles o escribibles para personas no deseadas"}], "lastModified": "2024-11-21T05:52:14.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D09560DA-1F1B-41AA-B96F-DABEE82C04D0", "versionEndExcluding": "1.4.9", "versionStartIncluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}