CyberRota Analysis
AI-GeneratedLiME versions up to 1.12.0 are vulnerable due to improper validation of the disk acquisition output path, which allows unprivileged local users to exploit symbolic links to overwrite arbitrary root-owned files. This vulnerability can lead to critical data loss or corruption when the acquisition process runs with kernel privileges. Organizations using LiME for memory acquisition should prioritize patching this issue to mitigate the risk of unauthorized file manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.