CVE-2012-0871: Race Condition
First published: Tue Feb 21 2012(Updated: )
Sebastian Krahmer of the SUSE Security Team reported that systemd-logind, a part of the systemd service and system manager, did not create certain special files in a secure way. systemd-logind is responsible for managing and tracking user login sessions, and if a user were to log into the X11 desktop, it creates entries in /run/user/[username]/X11, where /run/user/[username] is a user-owned directory. Because systemd-logind does not create the entries in a secure fashion, a malicious user could replace /run/user/[username]/X11 with a symlink to another root-owned directory, such as /etc/pam.d or /etc/cron.d. This would cause a symlink named "display" to be created in the target directory, which is a symlink to a user-owned file (/tmp/.X11-unix/X0). Using further attack vectors and this symlink, the malicious user could obtain a root shell, if he could beat two separate race conditions. Acknowledgements: Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Systemd Project Systemd | <=037 | |
| Systemd Project Systemd | =1 | |
| Systemd Project Systemd | =2 | |
| Systemd Project Systemd | =3 | |
| Systemd Project Systemd | =4 | |
| Systemd Project Systemd | =5 | |
| Systemd Project Systemd | =6 | |
| Systemd Project Systemd | =7 | |
| Systemd Project Systemd | =8 | |
| Systemd Project Systemd | =9 | |
| Systemd Project Systemd | =10 | |
| Systemd Project Systemd | =11 | |
| Systemd Project Systemd | =12 | |
| Systemd Project Systemd | =13 | |
| Systemd Project Systemd | =14 | |
| Systemd Project Systemd | =15 | |
| Systemd Project Systemd | =16 | |
| Systemd Project Systemd | =17 | |
| Systemd Project Systemd | =18 | |
| Systemd Project Systemd | =19 | |
| Systemd Project Systemd | =20 | |
| Systemd Project Systemd | =21 | |
| Systemd Project Systemd | =22 | |
| Systemd Project Systemd | =23 | |
| Systemd Project Systemd | =24 | |
| Systemd Project Systemd | =25 | |
| Systemd Project Systemd | =26 | |
| Systemd Project Systemd | =27 | |
| Systemd Project Systemd | =28 | |
| Systemd Project Systemd | =29 | |
| Systemd Project Systemd | =30 | |
| Systemd Project Systemd | =31 | |
| Systemd Project Systemd | =32 | |
| Systemd Project Systemd | =33 | |
| Systemd Project Systemd | =34 | |
| Systemd Project Systemd | =35 | |
| Systemd Project Systemd | =36 | |
| openSUSE openSUSE | =12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.html
- https://bugzilla.novell.com/show_bug.cgi?id=747154
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=799086
- https://bugzilla.redhat.com/show_bug.cgi?id=795853
- http://www.osvdb.org/79768
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-0871
- vendor/systemd project
- canonical/systemd project systemd
- version/systemd project systemd/037
- version/systemd project systemd/1
- version/systemd project systemd/2
- version/systemd project systemd/3
- version/systemd project systemd/4
- version/systemd project systemd/5
- version/systemd project systemd/6
- version/systemd project systemd/7
- version/systemd project systemd/8
- version/systemd project systemd/9
- version/systemd project systemd/10
- version/systemd project systemd/11
- version/systemd project systemd/12
- version/systemd project systemd/13
- version/systemd project systemd/14
- version/systemd project systemd/15
- version/systemd project systemd/16
- version/systemd project systemd/17
- version/systemd project systemd/18
- version/systemd project systemd/19
- version/systemd project systemd/20
- version/systemd project systemd/21
- version/systemd project systemd/22
- version/systemd project systemd/23
- version/systemd project systemd/24
- version/systemd project systemd/25
- version/systemd project systemd/26
- version/systemd project systemd/27
- version/systemd project systemd/28
- version/systemd project systemd/29
- version/systemd project systemd/30
- version/systemd project systemd/31
- version/systemd project systemd/32
- version/systemd project systemd/33
- version/systemd project systemd/34
- version/systemd project systemd/35
- version/systemd project systemd/36
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/12.1