Description
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.
Problem types
CWE-279: Incorrect Execution-Assigned Permissions
CWE-378: Creation of Temporary File With Insecure Permissions
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Product status
References
github.com/...squery/security/advisories/GHSA-fg78-9q98-62hh
github.com/osquery/osquery/pull/8961
github.com/...ommit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68
github.com/osquery/osquery/releases/tag/5.23.1