Vulnerability-Lookup

GHSA-9MC5-7QHG-FP3W

Vulnerability from github – Published: 2025-03-11 21:12 – Updated: 2026-02-08 01:00

Summary

Below has Incorrect Permission Assignment for Critical Resource

Details

Impact

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Patches

https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83

This is included in version 0.9.0

Workarounds

Change the permission on /var/log/below manually

References

https://www.facebook.com/security/advisories/cve-2025-27591 https://www.cve.org/CVERecord?id=CVE-2025-27591

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "below"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-11T21:12:54Z",
    "nvd_published_at": "2025-03-11T19:15:43Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.\n\n### Patches\nhttps://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83\n\nThis is included in version 0.9.0\n\n### Workarounds\nChange the permission on `/var/log/below` manually\n\n### References\nhttps://www.facebook.com/security/advisories/cve-2025-27591\nhttps://www.cve.org/CVERecord?id=CVE-2025-27591",
  "id": "GHSA-9mc5-7qhg-fp3w",
  "modified": "2026-02-08T01:00:10Z",
  "published": "2025-03-11T21:12:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facebookincubator/below/security/advisories/GHSA-9mc5-7qhg-fp3w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27591"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facebookincubator/below"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0149.html"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2025-27591"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2025/03/12/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/03/12/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Below has Incorrect Permission Assignment for Critical Resource"
}

CVE-2025-27591 (GCVE-0-2025-27591)

Vulnerability from cvelistv5 – Published: 2025-03-11 18:29 – Updated: 2025-03-21 20:38

Summary

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-21 20:37 UTC

CWE

Incorrect Permission Assignment for Critical Resource (CWE-732)

Assigner

facebook

References

3 references

URL	Tags
https://www.facebook.com/security/advisories/cve-…	x_refsource_CONFIRM
https://github.com/facebookincubator/below/commit…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2025/03/12/1

Impacted products

1 product

Vendor	Product	Version
Meta Platforms, Inc	below	Affected: 0.0.0 , < 0.9.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-12T13:08:26.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-27591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T20:37:38.689510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T20:38:10.292Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "below",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "0.9.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2025-03-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Permission Assignment for Critical Resource (CWE-732)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T18:29:21.569Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "facebook"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2025-27591"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "facebook",
    "cveId": "CVE-2025-27591",
    "datePublished": "2025-03-11T18:29:21.569Z",
    "dateReserved": "2025-03-03T11:36:32.537Z",
    "dateUpdated": "2025-03-21T20:38:10.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

rustsec-2025-0149

Vulnerability from osv_rustsec

Published

2025-03-12 12:00

Modified

2026-02-08 07:26

Summary

World Writable Directory in /var/log/below Allows Local Privilege Escalation

Details

Below is a tool for recording and displaying system data like hardware utilization and cgroup information on Linux.

Symlink Attack in `/var/log/below/error_root.log`

Below's systemd service runs with full root privileges. It attempts to create a world-writable directory in /var/log/below. Even if the directory already exists, the Rust code ensures 1 that it receives mode 0777 permissions:

    if perm.mode() & 0o777 != 0o777 {
        perm.set_mode(0o777);
        match dir.set_permissions(perm) {
            Ok(()) => {}
            Err(e) => {
                bail!(
                    "Failed to set permissions on {}: {}",
                    path.to_string_lossy(),
                    e
                );
            }
        }
    }

This logic leads to different outcomes depending on the packaging on Linux distributions:

in openSUSE Tumbleweed the directory was packaged with 01755 permissions (below.spec 2 line 73), thus causing the set_permissions() call to run, resulting in a directory with mode 0777 during runtime.
in Gentoo Linux the directory is created with mode 01755 resulting in the same outcome as on openSUSE Tumbleweed (below.ebuild 3). Where the 01755 mode is exactly coming from is not fully clear, maybe the cargo build process assigns these permissions during installation.
in Fedora Linux the directory is packaged with 01777 permissions, thus the set_permissions() code will not run, because the if condition masks out the sticky bit. The directory stays at mode 01777 (rust-below.spec 4).
the Arch Linux AUR package 5 (maybe wrongly) does not pre-create the log directory. Thus the set_permissions() code will run and create the directory with mode 0777.

Below creates a log file in /var/log/below/error_root.log and assigns mode 0666 to it. This (somewhat confusingly) happens via a log_dir variable 6, which has been changed to point to the error_root.log file. The 0666 permission assignment to the logfile happens in logging::setup() 7, also accompanied by a somewhat strange comment in the code.

A local unprivileged attacker can stage a symlink attack in this location and cause an arbitrary file in the system to obtain 0666 permissions, likely leading to a full local root exploit, if done right, e.g. by pointing the symlink to /etc/shadow. Even if the file already exists it can be removed and replaced by a symlink, because of the world-writable directory permissions. The attack is thus not limited to scenarios in which the file has not yet been created by Below.

Further Issues

Even on Fedora Linux, where /var/log/below has "safe" 01777 permissions, there is a time window during which problems can arise. As long as below.service has not been started, another local user can pre-create /var/log/below/error_root.log and e.g. place a FIFO special file there. This will pose a local DoS against the below service, since it will fail to open the path and thus fail to start.

If /var/log/below were to be deleted for any reason, then Below would still recreate it using the bad 0777 mode permissions, which can also happen on distributions that initially package /var/log/below using permissions that do not trigger the set_permissions() call in Below's code.

Severity

7.3 (High)


                    
                      CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

URL

Type

	https://crates.io/crates/below	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2025-0149.html	ADVISORY
	https://www.openwall.com/lists/oss-security/2025/…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "privilege-escalation"
        ],
        "cvss": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "below",
        "purl": "pkg:cargo/below"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2025-27591",
    "GHSA-9mc5-7qhg-fp3w"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Below is a tool for recording and displaying system data like\nhardware utilization and cgroup information on Linux.\n\n## Symlink Attack in `/var/log/below/error_root.log`\n\nBelow\u0027s systemd service runs with full `root` privileges. It attempts to\ncreate a world-writable directory in `/var/log/below`. Even if the\ndirectory already exists, the Rust code ensures [1] that it receives\nmode 0777 permissions:\n\n```\n    if perm.mode() \u0026 0o777 != 0o777 {\n        perm.set_mode(0o777);\n        match dir.set_permissions(perm) {\n            Ok(()) =\u003e {}\n            Err(e) =\u003e {\n                bail!(\n                    \"Failed to set permissions on {}: {}\",\n                    path.to_string_lossy(),\n                    e\n                );\n            }\n        }\n    }\n```\n\nThis logic leads to different outcomes depending on the packaging on Linux\ndistributions:\n\n- in openSUSE Tumbleweed the directory was packaged with 01755\n  permissions (below.spec [2] line 73), thus causing the\n  `set_permissions()` call to run, resulting in a directory with mode\n  0777 during runtime.\n- in Gentoo Linux the directory is created with mode 01755 resulting in\n  the same outcome as on openSUSE Tumbleweed (below.ebuild [3]).  Where\n  the 01755 mode is exactly coming from is not fully clear, maybe the\n  `cargo` build process assigns these permissions during installation.\n- in Fedora Linux the directory is packaged with 01777 permissions, thus\n  the `set_permissions()` code will not run, because the `if` condition\n  masks out the sticky bit. The directory stays at mode 01777\n  (rust-below.spec [4]).\n- the Arch Linux AUR package [5] (maybe wrongly) does not pre-create\n  the log directory. Thus the `set_permissions()` code will run and\n  create the directory with mode 0777.\n\nBelow creates a log file in `/var/log/below/error_root.log` and assigns\nmode 0666 to it. This (somewhat confusingly) happens via a `log_dir`\nvariable [6], which has been changed to point to the `error_root.log`\nfile. The 0666 permission assignment to the logfile happens in\n`logging::setup()` [7], also accompanied by a somewhat strange comment\nin the code.\n\nA local unprivileged attacker can stage a symlink attack in this\nlocation and cause an arbitrary file in the system to obtain 0666\npermissions, likely leading to a full local root exploit, if done right,\ne.g. by pointing the symlink to `/etc/shadow`. Even if the file already\nexists it can be removed and replaced by a symlink, because of the\nworld-writable directory permissions. The attack is thus not limited to\nscenarios in which the file has not yet been created by Below.\n\n## Further Issues\n\nEven on Fedora Linux, where `/var/log/below` has \"safe\" 01777\npermissions, there is a time window during which problems can arise. As\nlong as `below.service` has not been started, another local user can\npre-create `/var/log/below/error_root.log` and e.g. place a FIFO special\nfile there. This will pose a local DoS against the below service, since\nit will fail to open the path and thus fail to start.\n\nIf `/var/log/below` were to be deleted for any reason, then Below would\nstill recreate it using the bad 0777 mode permissions, which can also\nhappen on distributions that initially package `/var/log/below` using\npermissions that do not trigger the `set_permissions()` call in Below\u0027s\ncode.\n\n[1]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/main.rs#L379\n[2]: https://build.opensuse.org/projects/openSUSE:Factory/packages/below/files/below.spec?expand=1\u0026rev=5e78e7f743f87bea8648eeee673c649b\n[3]: https://github.com/gentoo/gentoo/blob/master/sys-process/below/below-0.8.1-r1.ebuild#L344\n[4]: https://src.fedoraproject.org/rpms/rust-below/blob/6ae58353b5d12e58462425c20a2aedfbae2e769a/f/rust-below.spec#_108\n[5]: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=below#n34\n[6]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/main.rs#L552\n[7]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/open_source/logging.rs#L68",
  "id": "RUSTSEC-2025-0149",
  "modified": "2026-02-08T07:26:28Z",
  "published": "2025-03-12T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/below"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0149.html"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2025/03/12/1"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "World Writable Directory in /var/log/below Allows Local Privilege Escalation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9MC5-7QHG-FP3W

Impact

Patches

Workarounds

References

CVE-2025-27591 (GCVE-0-2025-27591)

rustsec-2025-0149

Vulnerability from osv_rustsec

Symlink Attack in /var/log/below/error_root.log

Further Issues

Tags

Sightings

Nomenclature

Related by attack behaviour

Symlink Attack in `/var/log/below/error_root.log`