Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Base-service, and any of the maintainers: @xiezhipeng1 , @licihua , @yanan-rock , @zhujianwei001 , @overweight , @dillon_chen
@xiezhipeng1 ,@licihua ,@yanan-rock ,@zhujianwei001 ,@overweight ,@dillon_chen
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.
影响性分析说明:
openEuler评分: (评分和向量)
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142
/check-issue
经过cve-manager解析，部分字段填写错误，如红色字体所示：
影响性分析说明:
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() ...
openEuler评分: (评分和向量)
5.3
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响):
1.master:受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-22.03-LTS-SP4:受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:受影响
8.openEuler-24.03-LTS-SP1:(请填写此字段)
9.openEuler-24.03-LTS-SP2:(请填写此字段)
10.openEuler-24.03-LTS-SP3:(请填写此字段)
修复是否涉及abi变化(是/否)：
1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-22.03-LTS-SP4:否
6.openEuler-24.03-LTS:否
7.openEuler-24.03-LTS-Next:否
8.openEuler-24.03-LTS-SP1:(请填写此字段)
9.openEuler-24.03-LTS-SP2:(请填写此字段)
10.openEuler-24.03-LTS-SP3:(请填写此字段)
原因说明：
影响性分析
| 项目 | 内容 |
|---|---|
| CVE 编号 | CVE-2023-30571 |
| openEuler-26.09 版本 | libarchive 3.8.9-1 |
| 是否受影响 | 是 |
分析
漏洞位于 （写盘时读取 umask 的方式）：
- L649 与 L2018 均使用
- 该写法会短暂将进程 umask 置 0。多线程进程中，其他线程在此窗口内创建的文件/目录会以 0777 权限落盘（安全敏感：隐式目录可被任意用户写入）
openEuler-26.09 的 libarchive 3.8.9（2026-07-28 发布）包含漏洞形态。上游从未在正式版本中发布修复（3.7.1 / 3.7.2 / 3.8.0 / 3.8.9 均带旧写法，上游 issue #1876 至今 open），修复只存在于 master：
- 70d36b909ab2 unify helper to read current umask（新增 archive_umask.c，posix/windows 各 2 处替换为 ）
- 065488cd453a Linux 下从 /proc/self/status 读取 umask（kernel ≥ 4.7，完全无竞态）
- 8266767d50a2 HAVE_SYS_SINGLE_THREADED_H 单线程快路径守卫
修复
已提 PR #176：将上述 3 个 master commit 合并为单个 backport 补丁（新增 + ，替换 4 处进程级 调用）。
一、漏洞信息
漏洞编号：CVE-2023-30571
漏洞归属组件：libarchive
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-29 20:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
更多参考(点击展开)
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
详情(点击展开)
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.master(3.7.9):受影响
2.openEuler-20.03-LTS-SP4(3.4.3):受影响
3.openEuler-22.03-LTS-SP1(3.5.2):受影响
4.openEuler-22.03-LTS-SP3(3.5.2):受影响
5.openEuler-22.03-LTS-SP4(3.5.2):受影响
6.openEuler-24.03-LTS(3.7.1):受影响
7.openEuler-24.03-LTS-Next(3.7.1):受影响
8.openEuler-24.03-LTS-SP2(3.7.1):
修复是否涉及abi变化(是/否)：
1.master(3.7.9):否
2.openEuler-20.03-LTS-SP4(3.4.3):否
3.openEuler-22.03-LTS-SP1(3.5.2):否
4.openEuler-22.03-LTS-SP3(3.5.2):否
5.openEuler-22.03-LTS-SP4(3.5.2):否
6.openEuler-24.03-LTS(3.7.1):否
7.openEuler-24.03-LTS-Next(3.7.1):否
8.openEuler-24.03-LTS-SP2(3.7.1):
原因说明：
1.master(3.7.9):
2.openEuler-20.03-LTS-SP4(3.4.3):
3.openEuler-22.03-LTS-SP3(3.5.2):
4.openEuler-22.03-LTS-SP4(3.5.2):
5.openEuler-24.03-LTS(3.7.1):
6.openEuler-24.03-LTS-Next(3.7.1):
7.openEuler-24.03-LTS-SP1(3.7.1):
8.openEuler-24.03-LTS-SP2(3.7.1):