CVE-2022-25165

Katalog CVE

CVSS 7.0 · High EPSS 0,53%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada amazon aws client vpn. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.

Rincian

Terbit di NVD

14 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 42,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RhinoSecurityLabs/CVEs exploit · advisory pihak ketiga
• https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/ exploit · advisory pihak ketiga