CVE-2023-30571: Race Condition
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archivewritediskposix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-30571?
CVE-2023-30571 is a vulnerability in Libarchive through version 3.6.2 that can cause directories to have world-writable permissions.
What is the severity of CVE-2023-30571?
The severity of CVE-2023-30571 is medium with a severity value of 5.3.
How does CVE-2023-30571 impact Libarchive?
CVE-2023-30571 in Libarchive can lead to a race condition with another thread, resulting in a permanent umask 0 setting and directories having world-writable permissions.
How can I fix CVE-2023-30571 in Libarchive?
To fix CVE-2023-30571 in Libarchive, you should update to version 3.6.3 or later.
Where can I find more information about CVE-2023-30571?
You can find more information about CVE-2023-30571 in the Libarchive security advisory and the GitHub issue related to this vulnerability.