CVE-2021-44038 is a privilege escalation vulnerability affecting Quagga through version 1.2.4, stemming from unsafe chown/chmod operations during package installation or updates. This allows a local, low-privileged attacker who controls the /etc/quagga directory to gain root privileges. Rated with a CVSS score of 7.8 (High), the attack requires local access but has low complexity and no user interaction. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.2.4CPE matchmatch criteria | cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
quagga: unsafe chown/chmod operations may lead to privileges escalation
Nov 19, 2021An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.
Nov 9, 2021