CVE-2025-27148 (GCVE-0-2025-27148)
Vulnerability from cvelistv5
Published
2025-02-25 20:13
Modified
2025-02-25 21:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.
In net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class<>)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.
Gradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the "sticky" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T21:14:39.385419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T21:20:46.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "gradle",
"vendor": "gradle",
"versions": [
{
"status": "affected",
"version": "= 8.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.\n\nIn net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class\u003c\u003e)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.\n\nGradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the \"sticky\" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the \"sticky\" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-378",
"description": "CWE-378: Creation of Temporary File With Insecure Permissions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-379",
"description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T20:13:51.578Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r"
},
{
"name": "https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336"
},
{
"name": "https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8"
},
{
"name": "https://github.com/gradle/gradle/pull/32025",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gradle/gradle/pull/32025"
},
{
"name": "https://github.com/gradle/native-platform/pull/353",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gradle/native-platform/pull/353"
},
{
"name": "https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems",
"tags": [
"x_refsource_MISC"
],
"url": "https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems"
},
{
"name": "https://en.wikipedia.org/wiki/Sticky_bit",
"tags": [
"x_refsource_MISC"
],
"url": "https://en.wikipedia.org/wiki/Sticky_bit"
},
{
"name": "https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78"
}
],
"source": {
"advisory": "GHSA-465q-w4mf-4f4r",
"discovery": "UNKNOWN"
},
"title": "Gradle vulnerable to local privilege escalation through system temporary directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-27148",
"datePublished": "2025-02-25T20:13:51.578Z",
"dateReserved": "2025-02-19T16:30:47.778Z",
"dateUpdated": "2025-02-25T21:20:46.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-27148\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-02-25T21:15:18.073\",\"lastModified\":\"2025-02-25T21:15:18.073\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.\\n\\nIn net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class\u003c\u003e)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.\\n\\nGradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the \\\"sticky\\\" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the \\\"sticky\\\" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only.\"},{\"lang\":\"es\",\"value\":\"Gradle es una herramienta de automatizaci\u00f3n de compilaci\u00f3n y su herramienta de plataforma nativa proporciona enlaces Java para API nativas. En sistemas tipo Unix, el directorio temporal del sistema se puede crear con permisos abiertos que permiten que varios usuarios creen y eliminen archivos dentro de \u00e9l. Esta inicializaci\u00f3n de la librer\u00eda podr\u00eda ser vulnerable a una escalada de privilegios local por parte de un atacante que elimine y vuelva a crear r\u00e1pidamente archivos en el directorio temporal del sistema. Las compilaciones de Gradle que dependen de versiones de net.rubygrapefruit:native-platform anteriores a 0.22-milestone-28 podr\u00edan ser vulnerables a una escalada de privilegios local por parte de un atacante que elimine y vuelva a crear r\u00e1pidamente archivos en el directorio temporal del sistema. En net.rubygrapefruit:native-platform anterior a la versi\u00f3n 0.22-milestone-28, si se llamaba al m\u00e9todo `Native.get(Class\u0026lt;\u0026gt;)`, sin llamar primero a `Native.init(File)`, con un argumento distinto de `null` utilizado como ruta de archivo de trabajo, la librer\u00eda se inicializar\u00eda a s\u00ed misma utilizando el directorio temporal del sistema y las l\u00edneas 68 a 78 de NativeLibraryLocator.java. La versi\u00f3n 0.22-milestone-28 se ha publicado con cambios que solucionan el problema. La inicializaci\u00f3n ahora es obligatoria y ya no utiliza el directorio temporal del sistema, a menos que se pase dicha ruta para la inicializaci\u00f3n. El \u00fanico workaround para las versiones afectadas es asegurarse de realizar una inicializaci\u00f3n adecuada, utilizando una ubicaci\u00f3n que sea segura. Gradle 8.12, solo esa versi\u00f3n exacta, ten\u00eda rutas de c\u00f3digo donde la inicializaci\u00f3n de la librer\u00eda de integraci\u00f3n nativa subyacente tomaba una ruta predeterminada, dependiendo de la copia de los binarios al directorio temporal del sistema. Cualquier ejecuci\u00f3n de Gradle expon\u00eda esta vulnerabilidad. Los usuarios de Windows o versiones modernas de macOS no son vulnerables, como tampoco lo son los usuarios de un sistema operativo tipo Unix con el bit \\\"sticky\\\" configurado o \\\"noexec\\\" en su directorio temporal del sistema. Este problema se solucion\u00f3 en Gradle 8.12.1. La versi\u00f3n Gradle 8.13 tambi\u00e9n se actualiza a una versi\u00f3n de la librer\u00eda nativa que ya no tiene ese error. Hay algunas soluciones alternativas disponibles. En sistemas operativos tipo Unix, aseg\u00farese de que el bit \\\"sticky\\\" est\u00e9 configurado. Esto solo permite que el usuario original (o root) elimine un archivo. Montar \\\"/tmp\\\" como \\\"noexec\\\" evitar\u00e1 que se inicie Gradle 8.12. Aquellos que no puedan cambiar los permisos del directorio temporal del sistema pueden mover el directorio temporal de Java configurando la propiedad del sistema java.io.tmpdir. La nueva ruta debe limitar los permisos solo al usuario de compilaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-378\"},{\"lang\":\"en\",\"value\":\"CWE-379\"}]}],\"references\":[{\"url\":\"https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://en.wikipedia.org/wiki/Sticky_bit\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/gradle/pull/32025\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/native-platform/pull/353\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8\",\"source\":\"security-advisories@github.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27148\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-25T21:14:39.385419Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-25T21:14:42.721Z\"}}], \"cna\": {\"title\": \"Gradle vulnerable to local privilege escalation through system temporary directory\", \"source\": {\"advisory\": \"GHSA-465q-w4mf-4f4r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"gradle\", \"product\": \"gradle\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 8.12\"}]}], \"references\": [{\"url\": \"https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r\", \"name\": \"https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336\", \"name\": \"https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8\", \"name\": \"https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/gradle/gradle/pull/32025\", \"name\": \"https://github.com/gradle/gradle/pull/32025\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/gradle/native-platform/pull/353\", \"name\": \"https://github.com/gradle/native-platform/pull/353\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems\", \"name\": \"https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://en.wikipedia.org/wiki/Sticky_bit\", \"name\": \"https://en.wikipedia.org/wiki/Sticky_bit\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78\", \"name\": \"https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.\\n\\nIn net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class\u003c\u003e)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.\\n\\nGradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the \\\"sticky\\\" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the \\\"sticky\\\" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-378\", \"description\": \"CWE-378: Creation of Temporary File With Insecure Permissions\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-379\", \"description\": \"CWE-379: Creation of Temporary File in Directory with Insecure Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-02-25T20:13:51.578Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-27148\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-25T21:20:46.507Z\", \"dateReserved\": \"2025-02-19T16:30:47.778Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-02-25T20:13:51.578Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…