CVE-2022-1348
logrotate: potential DoS from unprivileged users via the state file
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 25, 2022
Updated · November 21, 2025
Description
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-732 · Incorrect Permission Assignment for Critical Resource