Lime
Monthly
Arbitrary root-owned file overwrite in LiME (Linux Memory Extractor) through 1.12.0 enables local privilege escalation via symlink injection during disk-mode memory acquisition. LiME opens the operator-supplied output path from within kernel context without setting O_NOFOLLOW and without validating the path for symbolic links, meaning an unprivileged local attacker who controls the acquisition output directory can pre-position a symlink pointing to any root-owned file and have it truncated or overwritten with the memory stream. A public proof-of-concept exploit exists, confirming the technique is reproducible; no CISA KEV listing has been identified at time of analysis.
Arbitrary root-owned file overwrite in LiME (Linux Memory Extractor) through 1.12.0 enables local privilege escalation via symlink injection during disk-mode memory acquisition. LiME opens the operator-supplied output path from within kernel context without setting O_NOFOLLOW and without validating the path for symbolic links, meaning an unprivileged local attacker who controls the acquisition output directory can pre-position a symlink pointing to any root-owned file and have it truncated or overwritten with the memory stream. A public proof-of-concept exploit exists, confirming the technique is reproducible; no CISA KEV listing has been identified at time of analysis.