CVE-2024-45339

Name of the Vulnerable Software and Affected Versions glog (affected versions not specified)

Description The issue arises when logs are written to a widely-writable directory, allowing an unprivileged attacker to predict a privileged process's log file path and create a symbolic link to a sensitive file in its place. When the privileged process runs, it follows the planted symlink and overwrites the sensitive file. To address this, glog now exits the program with a status code of 2 when it discovers that the configured log file already exists.

Recommendations To resolve the issue, ensure that glog is configured to write logs to a directory that is not widely writable. As a temporary workaround, consider restricting write access to the log directory to prevent unprivileged attackers from creating symbolic links to sensitive files. Avoid using widely-writable directories for logging until the issue is fully addressed.