ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.

As noted in the SUSE bug report [1], numerous /tmp race conditions exist in ppc64-diag, in particular:

rtaserrd/diagsupport.c:233: char command[]="/usr/bin/find /proc/device-tree -name status -print > /tmp/getdtfiles"; rtaserrd/diagsupport.c:241: fp1 = fopen("/tmp/getdtfiles", "r"); rtaserrd/prrnhotplug:8:TMPFILE=mktemp -p /tmp scripts/ppc64diagmkrsrc:126:mkdir "/tmp/diagSEsnap", 0775; scripts/ppc64diagmkrsrc:127:$generaleedfile = "/tmp/diagSEsnap/snapH.tar.gz";

In the case of rtaserrd/prrnhotplug, mktemp is used but is assumed to have succeeded; there is no check for the return value.

mktemp should probably be used properly in all of these. I don't know if the data in /tmp/diagSEsnap is sensitive or not, but if it is, the permissions on that directory should probably be tightened up.

No CVE(s) have been assigned to these issues as of yet.

[1] https://bugzilla.novell.com/showbug.cgi?id=882667