CVE-2015-7358 Privilege escalation in n/a
Local attackers can mount encrypted volumes over existing drive letters to gain elevated privileges on Windows systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-7358?
CVE-2015-7358 is a high-severity vulnerability in n/a, published on 2 Oct 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.
Weakness: CWE-264
Which versions are affected by CVE-2015-7358?
It affects 3 products.
Products include Ciphershed Ciphershed, Idrix Veracrypt, Truecrypt Truecrypt.
How do I fix CVE-2015-7358?
No fix has been published for CVE-2015-7358 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-7358 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-7358 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4c78-fxq8-6rxg.