« Volver al listado

CVE-2014-0748

Estado: ModificadaAlta (7.2)—

apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cray — Cray Linux Environment

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0748",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-27T02:59:00.053",
  "references": [
    {
      "url": "https://labs.mwrinfosecurity.com/advisories/2014/01/31/cray-aprunapinit-privilege-escalation/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://labs.mwrinfosecurity.com/advisories/2014/01/31/cray-aprunapinit-privilege-escalation/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912."
    },
    {
      "lang": "es",
      "value": "apinit en dispositivos Cray con CLE anterior 4.2.UP02 y 5.x anterior a 5.1.UP00 no utiliza los datos alpsauth para validar el UID en el mensaje, lo que permite a usuarios locales obtener privilegios a través de un programa modificado aprun, también conocido como ID FN5912."
    }
  ],
  "lastModified": "2026-06-17T00:03:34.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cray:cray_linux_environment:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2388E110-F342-4720-B8EB-5E8530113446",
              "versionEndIncluding": "4.2"
            },
            {
              "criteria": "cpe:2.3:o:cray:cray_linux_environment:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F940F30-BF94-4114-9B6B-B85C4E5205E9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}