CVE-2019-15316: Race Condition
Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15316?
CVE-2019-15316 is a vulnerability in the Valve Steam Client for Windows that allows for privilege escalation via weak folder permissions.
How severe is CVE-2019-15316?
CVE-2019-15316 has a severity rating of high, with a severity value of 7.
How can CVE-2019-15316 be exploited?
CVE-2019-15316 can be exploited by leveraging a TOCTOU race condition using CreateMountPoint.exe and SetOpLock.exe to escalate privileges to NT AUTHORITY\SYSTEM.
Is Microsoft Windows affected by CVE-2019-15316?
No, Microsoft Windows is not affected by CVE-2019-15316.
What are the Common Weakness Enumeration (CWE) IDs associated with CVE-2019-15316?
CVE-2019-15316 is associated with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')), CWE-367 (Time-of-Check Time-of-Use (TOCTOU) Race Condition), and CWE-732 (Incorrect Permission Assignment for Critical Resource).