CVE-2021-29428
📋 TL;DR
This vulnerability allows local privilege escalation on Unix-like systems by exploiting insecure permissions in the system temporary directory. Attackers can delete and recreate files during Gradle builds, potentially gaining elevated privileges. It affects builds using precompiled Kotlin DSL script plugins or Gradle plugin tests with ProjectBuilder/TestKit.
💻 Affected Systems
- Gradle
📦 What is this software?
Gradle by Gradle
Quarkus by Quarkus
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root/administrator privileges on the system, leading to complete system compromise.
Likely Case
Local user escalates privileges to another user account, potentially accessing sensitive build artifacts or configuration files.
If Mitigated
With sticky bit set or proper permissions, only original user can delete files, preventing privilege escalation.
🎯 Exploit Status
Requires local access and timing to delete/recreate files during specific build operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0
Vendor Advisory: https://docs.gradle.org/7.0/release-notes.html#security-advisories
Restart Required: No
Instructions:
1. Upgrade Gradle to version 7.0 or later. 2. Update build scripts to use new version. 3. Verify builds complete successfully.
🔧 Temporary Workarounds
Set sticky bit on temp directory
linuxSet sticky bit on system temporary directory to prevent other users from deleting files
chmod +t /tmp
Change Java temporary directory
allMove Java temporary directory to a location with restricted permissions
export JAVA_OPTS="-Djava.io.tmpdir=/secure/tmp"
gradle build
🧯 If You Can't Patch
- Ensure system temporary directory has sticky bit set (chmod +t /tmp)
- Run Gradle builds with isolated temporary directories using java.io.tmpdir system property
🔍 How to Verify
Check if Vulnerable:
Check Gradle version with 'gradle --version' and verify if below 7.0. Check temp directory permissions with 'ls -ld /tmp' - should show 'drwxrwxrwt' for sticky bit.Check Version:
gradle --version | grep GradleVerify Fix Applied:
Confirm Gradle version is 7.0+ with 'gradle --version'. Verify temp directory has sticky bit with 'ls -ld /tmp'.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion/recreation in /tmp during builds
- Permission denied errors in temp directory
Network Indicators:
- None - local attack only
SIEM Query:
process.name:"gradle" AND file.path:"/tmp/*" AND file.action:"delete"🔗 References
- https://docs.gradle.org/7.0/release-notes.html#security-advisories
- https://github.com/gradle/gradle/pull/15240
- https://github.com/gradle/gradle/pull/15654
- https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336
- https://docs.gradle.org/7.0/release-notes.html#security-advisories
- https://github.com/gradle/gradle/pull/15240
- https://github.com/gradle/gradle/pull/15654
- https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336
