.NET Elevation of Privilege Vulnerability

Vulnerability

Overview

CVE-2025-55247 is an improper link resolution before file access ('link following') vulnerability in .NET's MSBuild component, affecting versions 8.0, 9.0, and 10.0 on Linux operating systems [1]. The root cause lies in MSBuild's use of predictable paths for temporary directories during build operations, which allows a local attacker to create those directories ahead of MSBuild, leading to a denial of service (DoS) condition [1].

Exploitation

An authorized attacker with local access to a Linux system can exploit this vulnerability by pre-creating the predictable temporary directories that MSBuild expects to use. This attack requires no special privileges beyond local user access and is specific to builds that utilize the DownloadFile build task [1]. The vulnerability does not affect Windows systems and is limited to .NET SDK installations on Linux [1].

Impact

Successful exploitation results in a denial of service against .NET builds, preventing legitimate build operations from completing. The attacker can disrupt development workflows and CI/CD pipelines that rely on MSBuild, potentially causing significant operational delays [1]. The vulnerability is classified as a local privilege escalation issue, though the primary impact is availability rather than data confidentiality or integrity [1].

Mitigation

Microsoft has released patches for all affected .NET SDK versions, including .NET 10.0.100-rc.1.25451.107, .NET 9.0.110/9.0.305, and .NET 8.0.120/8.0.317/8.0.414 [1]. Developers should update to the latest patched versions of the affected packages: Microsoft.Build.Tasks.Core, Microsoft.Build, and Microsoft.Build.Utilities.core [1]. Projects that do not use the DownloadFile build task are not susceptible to this vulnerability [1].