A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.

The serial backend, historically part of Apple CUPS, is not present in OpenPrinting CUPS HEAD (v2.5b1, commit 7cf4b97). Red Hat and Fedora ship it from the cups-filters package as /usr/lib/cups/backend/serial (or /usr/libexec/cups/backend/serial), installed root:root mode 0700 (RHEL 10 uses 0744). That mode still causes cupsd to run the backend as root. An lpadmin (SystemGroup) user can therefore configure a serial: device URI that causes a root-privileged backend to write job data to an attacker-chosen path, including cups-files.conf. cups-files.conf is otherwise protected from lpadmin HTTP PUT (restricted to cupsd.conf).

Impact: local privilege escalation from CUPS administrator (lpadmin) to OS root when the serial backend is installed.

Affected packaging: cups-filters serial backend on Fedora 43/44/45 and RHEL 8/9/10 (c8s/c9s/c10s specs). OpenPrinting CUPS core on HEAD does not build serial.

Fix: not yet available from upstream for this chain.

Reporter: Akiyoshi Kurita (Red Hat), forwarding the public cups2root report by v12-security. PSIRT Ticket: PSIRTSUPT-24165

A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.

The serial backend, historically part of Apple CUPS, is not present in OpenPrinting CUPS HEAD (v2.5b1, commit 7cf4b97). Red Hat and Fedora ship it from the cups-filters package as /usr/lib/cups/backend/serial (or /usr/libexec/cups/backend/serial), installed root:root mode 0700 (RHEL 10 uses 0744). That mode still causes cupsd to run the backend as root. An lpadmin (SystemGroup) user can therefore configure a serial: device URI that causes a root-privileged backend to write job data to an attacker-chosen path, including cups-files.conf. cups-files.conf is otherwise protected from lpadmin HTTP PUT (restricted to cupsd.conf).

Impact: local privilege escalation from CUPS administrator (lpadmin) to OS root when the serial backend is installed.

Affected packaging: cups-filters serial backend on Fedora 43/44/45 and RHEL 8/9/10 (c8s/c9s/c10s specs). OpenPrinting CUPS core on HEAD does not build serial.

Fix: not yet available from upstream for this chain.

Reporter: Akiyoshi Kurita (Red Hat), forwarding the public cups2root report by v12-security. PSIRT Ticket: PSIRTSUPT-24165