CVE-2012-0871: Race Condition
Sebastian Krahmer of the SUSE Security Team reported that systemd-logind, a part of the systemd service and system manager, did not create certain special files in a secure way. systemd-logind is responsible for managing and tracking user login sessions, and if a user were to log into the X11 desktop, it creates entries in /run/user/[username]/X11, where /run/user/[username] is a user-owned directory. Because systemd-logind does not create the entries in a secure fashion, a malicious user could replace /run/user/[username]/X11 with a symlink to another root-owned directory, such as /etc/pam.d or /etc/cron.d. This would cause a symlink named "display" to be created in the target directory, which is a symlink to a user-owned file (/tmp/.X11-unix/X0). Using further attack vectors and this symlink, the malicious user could obtain a root shell, if he could beat two separate race conditions.
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Other sources
The sessionlinkx11socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0871?
CVE-2012-0871 is classified as a medium severity vulnerability.
How do I fix CVE-2012-0871?
To fix CVE-2012-0871, update systemd to a version later than 37 which contains the security fix.
What software versions are affected by CVE-2012-0871?
CVE-2012-0871 affects systemd versions up to and including 37.
What type of vulnerability is CVE-2012-0871?
CVE-2012-0871 is a security vulnerability related to improper file permissions in systemd-logind.
Who reported CVE-2012-0871?
CVE-2012-0871 was reported by Sebastian Krahmer of the SUSE Security Team.