In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kotlin | Jetbrains | 1.4.0-milestone1 (including) | 1.4.0-milestone1 (including) |
| Kotlin | Jetbrains | 1.4.0-milestone2 (including) | 1.4.0-milestone2 (including) |
| Kotlin | Jetbrains | 1.4.0-milestone3 (including) | 1.4.0-milestone3 (including) |
| Kotlin | Jetbrains | 1.4.0-rc (including) | 1.4.0-rc (including) |
| Kotlin | Ubuntu | kinetic | * |
| Kotlin | Ubuntu | lunar | * |
| Kotlin | Ubuntu | mantic | * |
| Kotlin | Ubuntu | oracular | * |
| Kotlin | Ubuntu | plucky | * |
| Kotlin | Ubuntu | trusty | * |
| Kotlin | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html
References
- http://www.openwall.com/lists/oss-security/2020/12/06/1
- https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E
- https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- http://www.openwall.com/lists/oss-security/2020/12/06/1
- https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E
- https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E
- https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html