{"id":"CVE-2025-27591","aliases":["EUVD-2025-7209","GHSA-9mc5-7qhg-fp3w","RUSTSEC-2025-0149","openSUSE-SU-2026:10194-1"],"status":"published","title":"Below has Incorrect Permission Assignment for Critical Resource","description":"A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00372,"percentile":0.31352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-732"],"published":"2025-03-11T18:29:21Z","modified":"2026-10-28T02:30:26Z","exploits":[{"source":"pocgithub","id":"00xCanelo/CVE-2025-27591","title":"00xCanelo/CVE-2025-27591","date":"2025-07-19","url":"https://github.com/00xCanelo/CVE-2025-27591"},{"source":"pocgithub","id":"0x00Jeff/CVE-2025-27591","title":"0x00Jeff/CVE-2025-27591","date":"2025-11-19","url":"https://github.com/0x00Jeff/CVE-2025-27591"},{"source":"pocgithub","id":"0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591","title":"0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591","date":"2025-11-13","url":"https://github.com/0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591"},{"source":"pocgithub","id":"BridgerAlderson/CVE-2025-27591-PoC","title":"BridgerAlderson/CVE-2025-27591-PoC","date":"2025-07-13","url":"https://github.com/BridgerAlderson/CVE-2025-27591-PoC"},{"source":"pocgithub","id":"Cythonic1/CVE-2025-27591","title":"Cythonic1/CVE-2025-27591","date":"2025-07-31","url":"https://github.com/Cythonic1/CVE-2025-27591"},{"source":"pocgithub","id":"MoTechStore/CVE-2025-27591-PoC","title":"MoTechStore/CVE-2025-27591-PoC","date":"2026-07-15","url":"https://github.com/MoTechStore/CVE-2025-27591-PoC"},{"source":"pocgithub","id":"Stp1t/CVE-2025-27591","title":"Stp1t/CVE-2025-27591","date":"2026-01-02","url":"https://github.com/Stp1t/CVE-2025-27591"},{"source":"pocgithub","id":"Thekin-ctrl/CVE-2025-27591-Below","title":"Thekin-ctrl/CVE-2025-27591-Below","date":"2025-07-20","url":"https://github.com/Thekin-ctrl/CVE-2025-27591-Below"},{"source":"pocgithub","id":"VisaiCyber/CVE-2025-27591-below-","title":"VisaiCyber/CVE-2025-27591-below-","date":"2025-09-03","url":"https://github.com/VisaiCyber/CVE-2025-27591-below-"},{"source":"pocgithub","id":"alialucas7/CVE-2025-27591_PoC","title":"alialucas7/CVE-2025-27591_PoC","date":"2025-07-16","url":"https://github.com/alialucas7/CVE-2025-27591_PoC"},{"source":"pocgithub","id":"danil-koltsov/below-log-race-poc","title":"danil-koltsov/below-log-race-poc","date":"2025-09-01","url":"https://github.com/danil-koltsov/below-log-race-poc"},{"source":"pocgithub","id":"dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591","title":"dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591","date":"2025-07-15","url":"https://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591"},{"source":"pocgithub","id":"incommatose/CVE-2025-27591-PoC","title":"incommatose/CVE-2025-27591-PoC","date":"2025-07-18","url":"https://github.com/incommatose/CVE-2025-27591-PoC"},{"source":"pocgithub","id":"krn966/CVE-2025-27591","title":"krn966/CVE-2025-27591","date":"2025-10-18","url":"https://github.com/krn966/CVE-2025-27591"},{"source":"pocgithub","id":"obamalaolu/CVE-2025-27591","title":"obamalaolu/CVE-2025-27591","date":"2025-07-12","url":"https://github.com/obamalaolu/CVE-2025-27591"},{"source":"pocgithub","id":"rippsec/CVE-2025-27591-Meta-below-LPE","title":"rippsec/CVE-2025-27591-Meta-below-LPE","date":"2026-04-16","url":"https://github.com/rippsec/CVE-2025-27591-Meta-below-LPE"},{"source":"pocgithub","id":"rvzsec/CVE-2025-27591","title":"rvzsec/CVE-2025-27591","date":"2025-07-12","url":"https://github.com/rvzsec/CVE-2025-27591"},{"source":"pocgithub","id":"sefafl77/CVE-2025-27591-PoC","title":"sefafl77/CVE-2025-27591-PoC","date":"2025-08-10","url":"https://github.com/sefafl77/CVE-2025-27591-PoC"},{"source":"pocgithub","id":"umutcamliyurt/CVE-2025-27591","title":"umutcamliyurt/CVE-2025-27591","date":"2025-08-16","url":"https://github.com/umutcamliyurt/CVE-2025-27591"}],"fixes":[{"ecosystem":"crates.io","package":"below","fixed_in":["0.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit-advisory-db","fixed_in":["20260213-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"below","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"below","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"below","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit-advisory-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260213-1.1"}]}]}],"products":[{"vendor":"facebook","product":"below"},{"vendor":"meta platforms, inc","product":"below"}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-27591","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/12/1","tags":["Exploit","Mailing List","web"]},{"url":"https://github.com/facebookincubator/below/security/advisories/GHSA-9mc5-7qhg-fp3w","tags":["web"]},{"url":"https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27591","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0149.html","tags":["web","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2025/03/12/1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9mc5-7qhg-fp3w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27591.json","tags":["advisory"]},{"url":"https://github.com/facebookincubator/below","tags":["package"]},{"url":"https://crates.io/crates/below","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27591","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-27591","description":"A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.","status":"published","published":"2025-03-11T18:29:21.569Z","modified":"2025-03-21T20:38:10.292Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-7209","description":"A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.","status":"published","published":"2025-03-11T18:29:21Z","modified":"2025-03-21T20:38:10Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:55.622908Z"}],"ghsa":[{"id":"GHSA-9mc5-7qhg-fp3w","title":"Below has Incorrect Permission Assignment for Critical Resource","description":"### Impact\nA privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.\n\n### Patches\nhttps://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83\n\nThis is included in version 0.9.0\n\n### Workarounds\nChange the permission on `/var/log/below` manually\n\n### References\nhttps://www.facebook.com/security/advisories/cve-2025-27591\nhttps://www.cve.org/CVERecord?id=CVE-2025-27591","status":"published","published":"2025-03-11T21:12:54Z","modified":"2026-02-08T01:00:13Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2025-27591","description":"A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.","status":"published","published":"2025-03-11T19:15:43.39Z","modified":"2026-06-17T09:03:52.557Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"CVE-2025-27591","description":"A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.","status":"published","published":"2025-03-11T18:29:21.569Z","modified":"2026-10-28T02:30:26.446437608Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-9mc5-7qhg-fp3w","title":"Below has Incorrect Permission Assignment for Critical Resource","description":"### Impact\nA privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.\n\n### Patches\nhttps://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83\n\nThis is included in version 0.9.0\n\n### Workarounds\nChange the permission on `/var/log/below` manually\n\n### References\nhttps://www.facebook.com/security/advisories/cve-2025-27591\nhttps://www.cve.org/CVERecord?id=CVE-2025-27591","status":"published","published":"2025-03-11T21:12:54Z","modified":"2026-02-08T01:20:45.748583Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"RUSTSEC-2025-0149","title":"World Writable Directory in /var/log/below Allows Local Privilege Escalation","description":"Below is a tool for recording and displaying system data like\nhardware utilization and cgroup information on Linux.\n\n## Symlink Attack in `/var/log/below/error_root.log`\n\nBelow's systemd service runs with full `root` privileges. It attempts to\ncreate a world-writable directory in `/var/log/below`. Even if the\ndirectory already exists, the Rust code ensures [1] that it receives\nmode 0777 permissions:\n\n```\n    if perm.mode() \u0026 0o777 != 0o777 {\n        perm.set_mode(0o777);\n        match dir.set_permissions(perm) {\n            Ok(()) =\u003e {}\n            Err(e) =\u003e {\n                bail!(\n                    \"Failed to set permissions on {}: {}\",\n                    path.to_string_lossy(),\n                    e\n                );\n            }\n        }\n    }\n```\n\nThis logic leads to different outcomes depending on the packaging on Linux\ndistributions:\n\n- in openSUSE Tumbleweed the directory was packaged with 01755\n  permissions (below.spec [2] line 73), thus causing the\n  `set_permissions()` call to run, resulting in a directory with mode\n  0777 during runtime.\n- in Gentoo Linux the directory is created with mode 01755 resulting in\n  the same outcome as on openSUSE Tumbleweed (below.ebuild [3]).  Where\n  the 01755 mode is exactly coming from is not fully clear, maybe the\n  `cargo` build process assigns these permissions during installation.\n- in Fedora Linux the directory is packaged with 01777 permissions, thus\n  the `set_permissions()` code will not run, because the `if` condition\n  masks out the sticky bit. The directory stays at mode 01777\n  (rust-below.spec [4]).\n- the Arch Linux AUR package [5] (maybe wrongly) does not pre-create\n  the log directory. Thus the `set_permissions()` code will run and\n  create the directory with mode 0777.\n\nBelow creates a log file in `/var/log/below/error_root.log` and assigns\nmode 0666 to it. This (somewhat confusingly) happens via a `log_dir`\nvariable [6], which has been changed to point to the `error_root.log`\nfile. The 0666 permission assignment to the logfile happens in\n`logging::setup()` [7], also accompanied by a somewhat strange comment\nin the code.\n\nA local unprivileged attacker can stage a symlink attack in this\nlocation and cause an arbitrary file in the system to obtain 0666\npermissions, likely leading to a full local root exploit, if done right,\ne.g. by pointing the symlink to `/etc/shadow`. Even if the file already\nexists it can be removed and replaced by a symlink, because of the\nworld-writable directory permissions. The attack is thus not limited to\nscenarios in which the file has not yet been created by Below.\n\n## Further Issues\n\nEven on Fedora Linux, where `/var/log/below` has \"safe\" 01777\npermissions, there is a time window during which problems can arise. As\nlong as `below.service` has not been started, another local user can\npre-create `/var/log/below/error_root.log` and e.g. place a FIFO special\nfile there. This will pose a local DoS against the below service, since\nit will fail to open the path and thus fail to start.\n\nIf `/var/log/below` were to be deleted for any reason, then Below would\nstill recreate it using the bad 0777 mode permissions, which can also\nhappen on distributions that initially package `/var/log/below` using\npermissions that do not trigger the `set_permissions()` call in Below's\ncode.\n\n[1]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/main.rs#L379\n[2]: https://build.opensuse.org/projects/openSUSE:Factory/packages/below/files/below.spec?expand=1\u0026rev=5e78e7f743f87bea8648eeee673c649b\n[3]: https://github.com/gentoo/gentoo/blob/master/sys-process/below/below-0.8.1-r1.ebuild#L344\n[4]: https://src.fedoraproject.org/rpms/rust-below/blob/6ae58353b5d12e58462425c20a2aedfbae2e769a/f/rust-below.spec#_108\n[5]: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=below#n34\n[6]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/main.rs#L552\n[7]: https://github.com/facebookincubator/below/blob/v0.8.1/below/src/open_source/logging.rs#L68","status":"published","published":"2025-03-12T12:00:00Z","modified":"2026-02-08T07:26:28Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"openSUSE-SU-2026:10194-1","title":"cargo-audit-advisory-db-20260213-1.1 on GA media","description":"These are all security issues fixed in the cargo-audit-advisory-db-20260213-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-13T00:00:00Z","modified":"2026-03-23T04:54:33.153617Z","updated_at":"2026-11-02T16:58:38.101535Z"}]}}