CVE-2012-4454: Low severity Opencryptoki Project Opencryptoki vulnerability
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapixpk or (2) .pkcs11spinloc file in /tmp.
Other sources
opencryptoki, when compiled with -DSPINXPL (as it is in Red Hat Enterprise Linux and Fedora), creates certain dot files in the /tmp directory, such as .pkapixpk and .pkcs11spinloc. These are not temporary files and are rather used for locking purposes. They are created in a way that allows symlink attacks.
As files are opened RDWR, and not written to, they don't seem to allow file corruption as typical symlink attacks do. It is still possible to create new files at arbitrary locations (e.g. /etc/nologin) or make arbitrary file world writable (e.g. /etc/shadow) with the privileges of the user running pkcsslotd or an application using opencrpytoki library. Attacker does not need to be a member of the pkcs11 group, though symlinks would usually need to be created before the first use of the opencryptoki on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4454?
CVE-2012-4454 has a severity rating of medium due to its exploitation potential through symbolic link attacks.
How do I fix CVE-2012-4454?
To fix CVE-2012-4454, update to the latest version of Opencryptoki that addresses this vulnerability.
What versions of Opencryptoki are affected by CVE-2012-4454?
CVE-2012-4454 affects all Opencryptoki versions up to and including 2.4.
Can CVE-2012-4454 be exploited remotely?
CVE-2012-4454 requires local access to the vulnerable system for exploitation.
What is the nature of the vulnerability in CVE-2012-4454?
CVE-2012-4454 involves improper handling of lock files in the /tmp directory, allowing for potential symlink attacks.