diff --git a/crates/users/RUSTSEC-0000-0000.md b/crates/users/RUSTSEC-0000-0000.md index 7f1a5e711..9f0bf4dfb 100644 --- a/crates/users/RUSTSEC-0000-0000.md +++ b/crates/users/RUSTSEC-0000-0000.md @@ -11,10 +11,15 @@ patched = [] unaffected = ["<= 0.7.0"] ``` -# `root` appended to supplementary groups +# `root` unconditionally appended to group listings -Affected versions append the `root` group to the supplementary groups of a user, regardless of their actual membership. -This occurs unless the user is a member of exactly 1024 supplementary groups. +Affected versions append `root` to all group listings. +This occurs unless the correct listing has exactly 1024 groups. + +This affects both: + +- The supplementary groups of a user +- The groups of the current process If the caller uses this information for access control, this may lead to privilege escalation.