CVE-2015-7358 : The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCry

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.

Published 2017-10-03 01:29:01

Updated 2021-06-28 18:20:28

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-7358

Idrix » Veracrypt
Versions up to, including, (<=) 1.14
cpe:2.3:a:idrix:veracrypt:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Ciphershed » Ciphershed
Versions up to, including, (<=) 0.7.5.0
cpe:2.3:a:ciphershed:ciphershed:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Truecrypt » Truecrypt » Version: 7.0
cpe:2.3:a:truecrypt:truecrypt:7.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows

Exploit prediction scoring system (EPSS) score for CVE-2015-7358

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 24 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-7358

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-7358

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-7358

http://www.openwall.com/lists/oss-security/2015/09/24/3

oss-security - Re: CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege
Issue Tracking;Mailing List;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2015/09/22/7

oss-security - CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege
Mailing List;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.html

Truecrypt 7 Derived Code/Windows: Drive Letter Symbolic Link Creation Privilege Escalation ≈ Packet Storm
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/38403/

TrueCrypt 7 / VeraCrypt 1.13 - Drive Letter Symbolic Link Creation Privilege Escalation
Third Party Advisory;VDB Entry
https://veracrypt.codeplex.com/wikipage?title=Release%20Notes

VeraCrypt - CodePlex Archive
Release Notes;Vendor Advisory

CVEs referencing this url
https://code.google.com/p/google-security-research/issues/detail?id=538

538 - Truecrypt 7 Derived Code/Windows: Drive Letter Symbolic Link Creation EoP - project-zero - Monorail
Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-7358

Products affected by CVE-2015-7358

Exploit prediction scoring system (EPSS) score for CVE-2015-7358

CVSS scores for CVE-2015-7358

CWE ids for CVE-2015-7358

References for CVE-2015-7358