REDHAT-BUG-2531456: Race Condition
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition by using inotify to detect the socket creation, and then atomically exchanging the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root. This vulnerability affects gvfs versions 1.48.1 and newer.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated local attacker can exploit it. The attack relies on access to a user-controlled directory and the ability to race creation of a private D-Bus socket.
What does successful exploitation allow?
The attacker can cause the privileged gvfsd-admin daemon to change ownership of an arbitrary root-owned file by replacing a socket pathname with a symbolic link. They can then modify critical system files and escalate privileges to root.
Which gvfs versions are affected?
The issue affects gvfs version 1.48.1 and newer.