An information disclosure flaw was found in the way libuser, an user and group account administration library, performed movement of user's home directory. Previously, during the move the ownership of all the (sub)entries present in directory tree, to be moved, were changed from privileged user account to the effective user id of the user, the home directory should belong to. A local attacker could use this flaw to conduct hardlink attacks and possibly obtain unauthorized access to arbitrary system file.

This issue was found by Miloslav Trmač of Red Hat.

A TOCTOU (time-of-check time-of-use) race condition was found in the way libuser, a user and group account administration library, performed copying and removal of (user) directory trees. A local attacker, with permissions to write into particular directory, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of this directory (tree), if this directory was simultaneously modified (copied or removed) via libuser functionality.

This issue was found by Florian Weimer of Red Hat Product Security Team.