PT-2021-21363 · Cohesity · Cohesity Linux Agent

Philippe Grégoire + 1 · Published 2021-08-06 · Updated 2021-08-16 · CVE-2021-36795

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cohesity Linux agent versions 6.5.1b through 6.5.1d-hotfix10 Cohesity Linux agent versions 6.6.0a through 6.6.0b-hotfix1

Description A permission issue in the Cohesity Linux agent may allow privilege escalation. An underprivileged Linux user, if certain environment criteria are met, can gain additional privileges.

Recommendations For versions 6.5.1b through 6.5.1d-hotfix10, update to a version outside of this range to resolve the issue. For versions 6.6.0a through 6.6.0b-hotfix1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting privileges for underprivileged Linux users until a patch is available.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-36795

Affected Products

Cohesity Linux Agent

References · 4

• 🔥 https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-36795.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-36795 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36795 · Vendor Advisory
• https://t.me/cvenotify/19480 · Telegram Post