CVE-2023-30571

Publication date 29 May 2023

Last updated 26 August 2025

Ubuntu priority

Negligible

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

Description

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

Read the notes from the security team

Status

Package Ubuntu Release Status
libarchive 23.04 lunar Ignored
22.10 kinetic Ignored end of life, was deferred [2023-07-10]
22.04 LTS jammy Ignored
20.04 LTS focal Ignored
18.04 LTS bionic Ignored
16.04 LTS xenial Ignored
14.04 LTS trusty Ignored

Notes

mdeslaur

Upstream fix is just a documentation change to specify that users of libarchive need to use a mutex. We will not be releasing a security update to change the documentation. Marking this CVE as ignored for all releases.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libarchive

Severity score breakdown

Parameter Value
Base score 5.3 · Medium
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact Low
Availability impact High
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

References

Other references