-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.NETCore.App | nuget | >= 2.1.0, < 2.1.29 | 2.1.29 |
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.rhel.6-x64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 3.1.0, < 3.1.18 | 3.1.18 |
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.linux-arm | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.linux-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.linux-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.Mono.osx-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 5.0.0, < 5.0.9 | 5.0.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper file permission settings during crash dump creation. In Unix-like systems, the open()/creat() system calls' mode parameter determines file accessibility. The advisory explicitly states dumps were created with global read permissions, implying the runtime used modes like 0644 instead of restrictive 0600. The CreateDump logic in .NET Core's diagnostic component (located in debug/createdump modules) would be responsible for these file operations. While exact commit diffs aren't available, the vulnerability pattern matches insecure file permission handling in dump generation code paths, which was addressed in the patched versions by tightening permissions.