CVE-2010-4173: Race Condition
Leif Nixon reported that libsdp is vulnerable to insecure log file handling.
libsdp is a library that is supposed to be LDPRELOAD'd to enable an application to communicate over the Infiniband SDP protocol instead of ordinary TCP. When libsdp is dlopened, by default it will fopen a log file with a predictable name: /var/log/libsdp for root processes, and /tmp/libsdp.log.$UID for non-root processes. The root process log file is suitably protected, however the non-root processes are not.
The vulnerable code is in src/log.c, which does first check that the destination is not a symlink, in which case it will refuse to open it. However, this is still vulnerable to a hardlink attack, and a race condition where a symlink can be created between the lstat() call and the fopen() call:
192 / double check the file is not a link / 193 status = lstat(tfilename, &lstatres); 194 if ( (status == 0) && SISLNK(lstatres.stmode) ) { 195 sdplog( 9, "Cowardly refusing to log into:'%s'. " 196 "It is a link - thus is a security issue.\n", tfilename ); 197 return 0; 198 } 199 200 f = fopen( tfilename, "a" );
This vulnerability is fixed in the latest version of libsdp (libsdp-1.1.105-0.4.g1b9b996.tar.gz) available at: http://www.openfabrics.org/downloads/libsdp/
Acknowledgements:
Red Hat would like to thank Leif Nixon for reporting this issue.
Other sources
The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a (1) symlink or (2) hard link attack on the libsdp.log.##### temporary file.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4173?
CVE-2010-4173 is classified as a local privilege escalation vulnerability due to insecure log file handling.
How do I fix CVE-2010-4173?
To fix CVE-2010-4173, upgrade to libsdp version 1.1.105 or later where this issue is patched.
What versions of libsdp are vulnerable to CVE-2010-4173?
Versions of libsdp from 1.1.99 to 1.1.104 are vulnerable to CVE-2010-4173.
What type of attack can exploit CVE-2010-4173?
CVE-2010-4173 can be exploited through a symlink or hard link attack by local users.
Where does libsdp create vulnerable log files in relation to CVE-2010-4173?
Libsdp creates vulnerable log files in the /tmp directory, making them susceptible to overwriting by attackers.