PT-2021-18204 · Gradle+2 · Gradle+2

Big-Guy · Published 2021-04-13 · Updated 2024-03-06 · CVE-2021-29428

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Gradle versions prior to 7.0

Description: The issue affects Gradle builds on Unix-like systems, where the system temporary directory can be created with open permissions, allowing multiple users to create and delete files within it. This can lead to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. The vulnerability impacts builds using precompiled script plugins written in Kotlin DSL and tests for Gradle plugins written using ProjectBuilder or TestKit. Users on Windows or modern versions of macOS are not affected. Additionally, users on Unix-like operating systems with the "sticky" bit set on their system temporary directory are also not vulnerable.

Recommendations: For Gradle versions prior to 7.0, ensure that the "sticky" bit is set on the system temporary directory to prevent exploitation. As an alternative, move the Java temporary directory by setting the System Property java.io.tmpdir to a new path that limits permissions to the build user only. Update to Gradle version 7.0 or later, which includes the patch for this issue.

Exploit

Fix

LPE

Weakness Enumeration

CWE-379

CWE-378

Related Identifiers

BIT-GRADLE-2021-29428

CVE-2021-29428

GHSA-89QM-PXVM-P336

SUSE-SU-2023:1867-1

SUSE-SU-2023_1867-1

Affected Products

Debian

Gradle

Suse

References · 16

• 🔥 https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336 · Exploit
• https://github.com/gradle/gradle/pull/15240 · Patch
• https://github.com/gradle/gradle/pull/15654 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-29428 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29428 · Vendor Advisory
• https://docs.gradle.org/7.0/release-notes.html#security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29428 · Security Note
• https://ubuntu.com/security/CVE-2021-29428 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29428 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:1867-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gradle-2021-29428 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29428 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-29428 · Note
• https://bugzilla.suse.com/1184807 · Note