Leif Nixon reported that libsdp is vulnerable to insecure log file handling.

libsdp is a library that is supposed to be LDPRELOAD'd to enable an application to communicate over the Infiniband SDP protocol instead of ordinary TCP. When libsdp is dlopened, by default it will fopen a log file with a predictable name: /var/log/libsdp for root processes, and /tmp/libsdp.log.$UID for non-root processes. The root process log file is suitably protected, however the non-root processes are not.

The vulnerable code is in src/log.c, which does first check that the destination is not a symlink, in which case it will refuse to open it. However, this is still vulnerable to a hardlink attack, and a race condition where a symlink can be created between the lstat() call and the fopen() call:

192 / double check the file is not a link / 193 status = lstat(tfilename, &lstatres); 194 if ( (status == 0) && SISLNK(lstatres.stmode) ) { 195 sdplog( 9, "Cowardly refusing to log into:'%s'. " 196 "It is a link - thus is a security issue.\n", tfilename ); 197 return 0; 198 } 199 200 f = fopen( tfilename, "a" );

This vulnerability is fixed in the latest version of libsdp (libsdp-1.1.105-0.4.g1b9b996.tar.gz) available at: http://www.openfabrics.org/downloads/libsdp/

Acknowledgements:

Red Hat would like to thank Leif Nixon for reporting this issue.