CVE-2014-4038: Race Condition
As noted in the SUSE bug report [1], numerous /tmp race conditions exist in ppc64-diag, in particular:
rtaserrd/diagsupport.c:233: char command[]="/usr/bin/find /proc/device-tree -name status -print > /tmp/getdtfiles"; rtaserrd/diagsupport.c:241: fp1 = fopen("/tmp/getdtfiles", "r"); rtaserrd/prrnhotplug:8:TMPFILE=mktemp -p /tmp scripts/ppc64diagmkrsrc:126:mkdir "/tmp/diagSEsnap", 0775; scripts/ppc64diagmkrsrc:127:$generaleedfile = "/tmp/diagSEsnap/snapH.tar.gz";
In the case of rtaserrd/prrnhotplug, mktemp is used but is assumed to have succeeded; there is no check for the return value.
mktemp should probably be used properly in all of these. I don't know if the data in /tmp/diagSEsnap is sensitive or not, but if it is, the permissions on that directory should probably be tightened up.
No CVE(s) have been assigned to these issues as of yet.
[1] https://bugzilla.novell.com/showbug.cgi?id=882667
Other sources
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtaserrd/diagsupport.c and /tmp/getdtfiles, (2) scripts/ppc64diagmkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpdelatest.sh and /var/tmp/ras.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4038?
CVE-2014-4038 has a medium severity rating due to its potential for local privilege escalation.
How do I fix CVE-2014-4038?
To mitigate CVE-2014-4038, update affected software to the latest versions that patch the race condition vulnerabilities.
What systems are affected by CVE-2014-4038?
CVE-2014-4038 affects specific versions of SUSE Linux Enterprise Server and Red Hat Enterprise Linux.
What kind of vulnerability is CVE-2014-4038?
CVE-2014-4038 is a local privilege escalation vulnerability caused by race conditions in the ppc64-diag software.
Is CVE-2014-4038 exploit related to file permissions?
Yes, the exploit associated with CVE-2014-4038 typically involves manipulating temporary file permissions.