REDHAT-BUG-647941: Race Condition

First published: Fri Oct 29 2010(Updated: )

Leif Nixon reported that libsdp is vulnerable to insecure log file handling. libsdp is a library that is supposed to be LD_PRELOAD'd to enable an application to communicate over the Infiniband SDP protocol instead of ordinary TCP. When libsdp is dlopened, by default it will fopen a log file with a predictable name: /var/log/libsdp for root processes, and /tmp/libsdp.log.$UID for non-root processes. The root process log file is suitably protected, however the non-root processes are not. The vulnerable code is in src/log.c, which does first check that the destination is not a symlink, in which case it will refuse to open it. However, this is still vulnerable to a hardlink attack, and a race condition where a symlink can be created between the lstat() call and the fopen() call: 192 /* double check the file is not a link */ 193 status = lstat(tfilename, &amp;lstat_res); 194 if ( (status == 0) &amp;&amp; S_ISLNK(lstat_res.st_mode) ) { 195 __sdp_log( 9, "Cowardly refusing to log into:'%s'. " 196 "It is a link - thus is a security issue.\n", tfilename ); 197 return 0; 198 } 199 200 f = fopen( tfilename, "a" ); This vulnerability is fixed in the latest version of libsdp (libsdp-1.1.105-0.4.g1b9b996.tar.gz) available at: <a href="http://www.openfabrics.org/downloads/libsdp/">http://www.openfabrics.org/downloads/libsdp/</a> Acknowledgements: Red Hat would like to thank Leif Nixon for reporting this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2010-4173
• agent/type
• agent/last-modified-date
• agent/first-publish-date
• agent/weakness
• agent/severity
• agent/references
• agent/description
• agent/event
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/openfabrics
• canonical/openfabrics libsdp