CVE-2014-7272: Race Condition
It was reported that sddm has several issues leading to local privilege escalation:
[1]
The xauth cookie handling code calls xauth binary via popen() as root, which in turn dumps and creates files as root in users ~.
[2]
After xauth has done its job, sddm chowns() the ~/.Xauthority file to user. This is a race and a local root exploit.
[3]
The .xsession-errors file is created in ~ but as root. This allows to destroy arbitrary system files.
Upstream patch is at [4].
[1] https://bugzilla.suse.com/showbug.cgi?id=897788#c7 [2] https://bugzilla.suse.com/showbug.cgi?id=897788#c8 [3] https://bugzilla.suse.com/showbug.cgi?id=897788#c9 [4] https://github.com/sddm/sddm/pull/280
Other sources
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7272?
CVE-2014-7272 has been classified as a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2014-7272?
To fix CVE-2014-7272, update SDDM to a version greater than 0.10.0 to mitigate the vulnerability.
What systems are affected by CVE-2014-7272?
CVE-2014-7272 affects SDDM versions prior to 0.10.0 as well as Fedora versions 20 and 21.
What type of vulnerability is CVE-2014-7272?
CVE-2014-7272 is a local privilege escalation vulnerability related to improper handling of xauth cookies.
Can CVE-2014-7272 be exploited remotely?
No, CVE-2014-7272 is a local vulnerability that requires access to the affected system for exploitation.