Описание
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain the highest privileges on the system.
Отчет
This vulnerability is rated as an Important severity for Red Hat environments because improper file permissions on installed .NET components can allow an authenticated local user to modify system files and escalate privileges to root, compromising the entire host. Although the flaw grants full local compromise, exploitation is bounded by the prerequisite of having existing user access or shell execution on the underlying system, preventing remote unauthenticated exploitation. Systems running Red Hat Enterprise Linux in multi-user or shared hosting environments that execute .NET workloads are primarily exposed to this risk.
Меры по смягчению последствий
--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to correct file ownership and set restrictive write permissions across all extracted Linux .NET runtime and targeting pack directories: upgrade to ASP.NET Core Runtime 8.0.33, 9.0.22; .NET SDK 8.0.133, 9.0.123 (or the fixed Dotnet builds), which sets correct file ownership and permissions on Linux .NET tarball distributions to prevent unprivileged modification of runtime files, closing all 2 injection vectors (modification of runtime files with insecure ownership, binary or shared library replacement leading to privileged code execution). Until patched, this is only a concern on Linux systems hosting .NET runtimes or targeting packs installed from affected Linux tarballs with local user access — Standalone NuGet packages and other Microsoft-published non-ASP.NET .NET runtime and SDK tarballs are unaffected — so Restrict local shell access and audit or eliminate write permissions for non-root users across .NET runtime directories on multi-user hosts. As a compensating measure, Audit file write and modification syscalls directed at improperly owned .NET runtime directories and binaries with auditd, Enforce SELinux to restrict unprivileged processes from writing to system files or executing unauthorized code, Apply SELinux confined user mappings to restrict local users from modifying sensitive system files, Deploy EDR agents to detect and quarantine unauthorized runtime library modifications and privilege escalation attempts, Monitor writes to runtime directories and execution of unexpected child shells using Falco or eBPF runtime security, and Deploy AIDE file integrity monitoring to alert on unauthorized modifications or replacements of installed .NET binaries and libraries. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure file ownership defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | dotnet11.0 | Affected | ||
| Red Hat Enterprise Linux 9 | dotnet11.0 | Affected | ||
| Red Hat Hardened Images | dotnet10.0 | Not affected | ||
| Red Hat Hardened Images | dotnet9.0 | Not affected | ||
| Red Hat Enterprise Linux 10 | dotnet8.0 | Fixed | RHSA-2026:92428 | 29.10.2026 |
| Red Hat Enterprise Linux 10 | dotnet9.0 | Fixed | RHSA-2026:92430 | 29.10.2026 |
| Red Hat Enterprise Linux 10 | dotnet10.0 | Fixed | RHSA-2026:92438 | 29.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | dotnet8.0 | Fixed | RHSA-2026:93455 | 02.11.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | dotnet9.0 | Fixed | RHSA-2026:93458 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | dotnet8.0 | Fixed | RHSA-2026:92420 | 29.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
EPSS
7.8 High
CVSS3