REDHAT-BUG-2537749: High severity redhat/cups-filters vulnerability
A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.
The serial backend, historically part of Apple CUPS, is not present in OpenPrinting CUPS HEAD (v2.5b1, commit 7cf4b97). Red Hat and Fedora ship it from the cups-filters package as /usr/lib/cups/backend/serial (or /usr/libexec/cups/backend/serial), installed root:root mode 0700 (RHEL 10 uses 0744). That mode still causes cupsd to run the backend as root. An lpadmin (SystemGroup) user can therefore configure a serial: device URI that causes a root-privileged backend to write job data to an attacker-chosen path, including cups-files.conf. cups-files.conf is otherwise protected from lpadmin HTTP PUT (restricted to cupsd.conf).
Impact: local privilege escalation from CUPS administrator (lpadmin) to OS root when the serial backend is installed.
Affected packaging: cups-filters serial backend on Fedora 43/44/45 and RHEL 8/9/10 (c8s/c9s/c10s specs). OpenPrinting CUPS core on HEAD does not build serial.
Fix: not yet available from upstream for this chain.
Reporter: Akiyoshi Kurita (Red Hat), forwarding the public cups2root report by v12-security. PSIRT Ticket: PSIRTSUPT-24165
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who has CUPS administrative privileges through the lpadmin/SystemGroup role can exploit it. The issue elevates that CUPS administrator access to operating-system root.
Which systems are exposed?
Systems are exposed when the cups-filters package provides the serial backend at /usr/lib/cups/backend/serial or /usr/libexec/cups/backend/serial. Red Hat and Fedora package this backend, and its root-owned 0700 or 0744 mode causes cupsd to execute it as root.
What does an attacker need to do?
The attacker must be able to configure a printer with a serial: device URI. Because cupsd does not validate the URI path for this scheme, the root-run serial backend can be made to write print job data to an attacker-selected path, including cups-files.conf.
How can I determine whether a host is affected?
Check whether the serial backend exists at /usr/lib/cups/backend/serial or /usr/libexec/cups/backend/serial and whether users have lpadmin/SystemGroup CUPS administration privileges. The described vulnerable backend is installed root:root with mode 0700, or 0744 on RHEL 10.