CVE-2011-0727: Race Condition
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.
Other sources
It was discovered that the GNOME Display Manager (gdm) cleared the cache directory, which is owned by an unprivileged user, with the privileges of the root user. A race condition exists in gdm where a local user could take advantage of this by writing to the cache directory between ending the session and the signal to clean up the session, which could lead to the execution of arbitrary code as the root user.
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0727?
CVE-2011-0727 has been classified as a medium severity vulnerability due to its potential exploitation through local user permissions.
How do I fix CVE-2011-0727?
To mitigate CVE-2011-0727, update the GNOME Display Manager (gdm) to version 2.32.1 or later.
What systems are affected by CVE-2011-0727?
CVE-2011-0727 affects GNOME Display Manager (gdm) versions 2.0 through 2.32, including various intermediate releases.
What types of attacks can exploit CVE-2011-0727?
CVE-2011-0727 can be exploited through a symlink attack, allowing local users to change file ownership.
Who is impacted by CVE-2011-0727?
Local users on systems running vulnerable versions of GNOME Display Manager (gdm) are the primary targets of CVE-2011-0727.