CVE-2015-7358

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.

CVSS v3.0 NVD

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.21% chance of exploitation in the next 30 days, 68th percentile

Published

2017-10-02

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38403

Security advisories

• https://veracrypt.codeplex.com/wikipage?title=Release%20Notes
• http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter…
• http://www.openwall.com/lists/oss-security/2015/09/22/7
• http://www.openwall.com/lists/oss-security/2015/09/24/3
• https://code.google.com/p/google-security-research/issues/detail?id=538

References

• CVE Record
• NVD entry