Vulnerability · Published Jul 1, 2025 · Assigned by debian
CVE-2025-6297dpkg-deb: Fix cleanup for control member with restricted directories
High 8.2
In plain English
A high-severity incorrect permission assignment in dpkg from Debian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dpkg | 1.21.23 | DEBIAN-CVE-2025-6297 |
| Debian:13 | dpkg | 1.22.21 | DEBIAN-CVE-2025-6297 |
| Debian:14 | dpkg | 1.22.21 | DEBIAN-CVE-2025-6297 |
| Ubuntu:22.04:LTS | dpkg | 1.21.1ubuntu2.6 | UBUNTU-CVE-2025-6297 |
| Ubuntu:22.04:LTS | dpkg | 1.21.1ubuntu2.6 | USN-7768-1 |
| Ubuntu:24.04:LTS | dpkg | 1.22.6ubuntu6.5 | USN-7768-1 |
| Ubuntu:24.04:LTS | dpkg | 1.22.6ubuntu6.5 | UBUNTU-CVE-2025-6297 |
| Ubuntu:25.10 | dpkg | 1.22.21ubuntu1 | UBUNTU-CVE-2025-6297 |
Affected products (as reported)
Weakness: CWE-732, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N