7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53945

CVE-2025-53945: apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666:

bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache

This issue was introduced in commit 04f37e2 ("generate /etc/ld.so.cache (#1629)")(v0.27.0).

Impact

This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.

Patches

This issue was addressed in apko in aedb077 ("fix: /etc/ld.so.cache file permissions (#1758)") (v0.29.5).

Acknowledgements

Many thanks to Cody Harris from H2O.ai for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53945

CVE-2025-53945:

7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/apko	go	>= 0.27.0, < 0.29.5	0.29.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incorrect file permissions of /etc/ld.so.cache created by the apko tool during the image build process. The file was being created with 0666 permissions, which is world-writable.

The analysis of the introducing commit 04f37e2d50d5a502e155788561fb7d40de705bd9 reveals that the function build.Context.buildImage in pkg/build/build_implementation.go is responsible for this. The line lsc, err := bc.fs.Create("etc/ld.so.cache") creates the file with default insecure permissions.

The fixing commit aedb0772d6bf6e74d8f17690946dbc791d0f6af3 shows that the code responsible for creating the cache was likely refactored into a new function, build.updateCache. The fix is applied in this function by adding a fsys.Chmod("etc/ld.so.cache", 0644) call immediately after the file is written. This explicitly sets the file permissions to a secure value, readable by all but only writable by the owner.

Therefore, both build.Context.buildImage (in the initial vulnerable versions) and build.updateCache (in the later vulnerable versions) are the functions that would appear in a runtime profile during the build process that triggers this vulnerability. An attacker with local access to a container built with a vulnerable apko version could exploit this by modifying /etc/ld.so.cache to load a malicious shared library, leading to privilege escalation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.