Описание
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
A flaw was found in MSBuild’s temporary directory handling on Linux where predictable, non-randomized temporary paths are used. Local users can create or manipulate those paths before MSBuild runs, causing build failures or unexpected behavior and resulting in denial of service for build operations.
Отчет
The Red Hat Product Security team has assessed this issue as Moderate. Predictable MSBuild temporary directory paths on Linux allow a local user to precreate or manipulate build temp directories, causing build failures (denial of service) on shared build hosts or CI runners using the affected .NET packages.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | dotnet6.0 | Out of support scope | ||
| Red Hat Enterprise Linux 9 | dotnet7.0 | Out of support scope | ||
| Red Hat Enterprise Linux 10 | dotnet8.0 | Fixed | RHSA-2025:18152 | 15.10.2025 |
| Red Hat Enterprise Linux 10 | dotnet9.0 | Fixed | RHSA-2025:18153 | 15.10.2025 |
| Red Hat Enterprise Linux 10 | dotnet10.0 | Fixed | RHBA-2025:20993 | 11.11.2025 |
| Red Hat Enterprise Linux 8 | dotnet8.0 | Fixed | RHSA-2025:18148 | 15.10.2025 |
| Red Hat Enterprise Linux 8 | dotnet9.0 | Fixed | RHSA-2025:18150 | 15.10.2025 |
| Red Hat Enterprise Linux 9 | dotnet10.0 | Fixed | RHBA-2025:20916 | 11.11.2025 |
| Red Hat Enterprise Linux 9 | dotnet8.0 | Fixed | RHSA-2025:18149 | 15.10.2025 |
| Red Hat Enterprise Linux 9 | dotnet9.0 | Fixed | RHSA-2025:18151 | 15.10.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability
Уязвимость программной платформы .NET, связанная с некорректным определением символических ссылок в ходе осуществления доступа к файлу, позволяющая нарушителю повысить свои привилегии
EPSS
7.3 High
CVSS3