Gradle Native Platform Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the Gradle build automation tool, specifically within its native-platform component, in versions prior to 0.22-milestone-28. On Unix-like systems, the system temporary directory can have open permissions, allowing multiple users to create and delete files. This vulnerability arises when the 'Native.get(Class<>)' method is called without a proper initialization, leading to the unintentional use of the system temporary directory. In Gradle 8.12, this issue can be exploited by quickly deleting and recreating files in the temporary directory, potentially allowing an attacker to execute commands with elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to execute commands with elevated rights.

Reproduction

To reproduce this vulnerability, use Gradle 8.12 on a Unix-like system without the 'sticky' bit set on the temporary directory. The 'Native.get(Class<>)' method must be called without prior initialization, which will cause the library to load from the system temporary directory. Once the library is loaded, an attacker can exploit the vulnerability by rapidly deleting and recreating files in the temporary directory, which can be done manually or through a script.

Remediation

Users can upgrade to Gradle version 0.22-milestone-28 or later, where this vulnerability has been fixed. For those using Gradle 8.12, the update to version 8.12.1 also addresses this issue. If an immediate upgrade is not possible, the 'sticky' bit can be set on the system temporary directory to prevent unauthorized file deletions. Alternatively, the Java temporary directory can be moved by setting the 'java.io.tmpdir' system property to a path with restricted permissions.