Vulnerability feed

Executive summary

Isar, a tool that builds Linux root filesystems, has a flaw where the apt trusted GPG key directory is owned by the user running Isar instead of root. An unprivileged user inside the built image whose ID matches that calling user could alter or add trusted keys, which could weaken apt repository integrity protection. The advisory rates it Moderate with a CVSS 3.1 base score of 5.1 and recommends applying the patch or manually changing the directory owner to root.

Technical summary

The weakness is improper ownership of the /etc/apt/trusted.gpg.d directory, which is created during bootstrap and owned by the calling user rather than root, so this is a local integrity issue (CVSS vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires that the calling user's ID match an unprivileged user in the image, and the advisory states an attacker would also need to manipulate a remote repository or intercept non-secure communication with it. The issue has no impact on images using an immutable rootfs or where apt is never invoked. Affected versions are stated as >= 0.11, and the patch is identified as commit 29e84ed301c8 ('[PATCH] mmdebstrap: ensure apt keystore is owned by root'); a fixed release version is not stated. The workaround is to chown the directory to root:root in the setup step, as shown in the provided diff. No CWEs are listed, and detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/ilbers/isar/security/advisor…/GHSA-rq66-pfw5-whqq

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affects

ilbersIsarilbers isarIsar