DerScanner
Home / Vulnerability Database / C or C++ : Chroot() without chdir()
C/C++

C or C++ : Chroot() without chdir()

Classification

CWE
CWE-243

Overview

The chroot() call itself does not change the working directory, so if the new root is below the current directory, the application can still have access to outside resources.

References

  1. Best Practices for UNIX chroot() Operations
  2. CWE-243: Creation of chroot Jail Without Changing Working Directory
MEDIUM

DerScanner Severity Score

Do you want to fix C or C++ : Chroot() without chdir() in your application?

See also

C/C++

C or C++ : Dead store

C/C++

C or C++ : Use after free

C/C++

C or C++ : va_list uninitialized