.NET Elevation of Privilege Vulnerability Allowing Local Privilege Escalation

A vulnerability in .NET has been identified, allowing an authorized attacker to elevate privileges locally. This issue arises from improper link resolution before file access, a flaw that could be exploited by placing a malicious file in a core project path and waiting for an administrator to build a .NET project.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain elevated rights on the affected system.

Remediation

Users can download the security update for .NET 9.0 or .NET 8.0 installed on Linux from the .NET download website. Additional guidance can be found in the Microsoft Knowledge Base articles 5068332 and 5068331.