PT-2025-7918 · Gradle+1 · Gradle+1
Ljacomet
·
Published
2025-02-25
·
Updated
2025-02-28
·
CVE-2025-27148
CVSS v3.1
8.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
net.rubygrapefruit:native-platform versions prior to 0.22-milestone-28
Gradle version 8.12
Description
The issue concerns a local privilege escalation vulnerability in the native-platform tool of Gradle, a build automation tool. On Unix-like systems, an attacker could quickly delete and recreate files in the system temporary directory, potentially leading to privilege escalation. This vulnerability affects Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28. The problem arises when the
Native.get(Class<>) method is called without proper initialization using Native.init(File) first, causing the library to initialize itself using the system temporary directory.Recommendations
For net.rubygrapefruit:native-platform versions prior to 0.22-milestone-28, ensure proper initialization using a safe location by calling
Native.init(File) before Native.get(Class<>).
For Gradle version 8.12, upgrade to Gradle 8.12.1 or later, which fixes the issue.
As a temporary workaround for Gradle 8.12 on Unix-like operating systems, set the "sticky" bit on the system temporary directory to prevent unauthorized file deletion.
Alternatively, mount /tmp as noexec to prevent Gradle 8.12 from starting.
For users unable to change system temporary directory permissions, move the Java temporary directory by setting the System Property java.io.tmpdir to a path with limited permissions.Exploit
Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gradle
Net.Rubygrapefruit:Native-Platform