Disclosed weakness · no CVE recorded

GPUStack could leave local credentials readable by other users

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

Other accounts on the same host could read GPUStack credentials and assume some of the affected service’s permissions.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Credential files could inherit permissive operating-system defaults.

Conditions required

Another local account can read the files on a POSIX system with permissive creation settings.

Potential impact

Exposed signing or service credentials could allow impersonation within their scope.

Affected versions and configurations

<2.3.0

Fix and mitigation status

2.3.0 fixes this issue.

Practical next steps

Upgrade to 2.3.0 or a later release containing this fix. Review file permissions and rotate credentials that may already have been readable.

Operating lesson

Create credential files with owner-only permissions regardless of the process default.

Evidence and limits

GPUStack shipped 2.3.0 on October 23. GitHub records an edit to the release notes on October 26, when GPUStack published the dated advisory. No CVE was listed in the advisory at review.

Sources