Title: opentmpfiles root privilege escalation by symlink attack. Author: Michael Orlitzky.
Title: opentmpfiles root privilege escalation by symlink attack. Author: Michael Orlitzky.
Summary
The opentmpfiles program implements the tmpfiles.d specification for POSIX systems that do not run systemd. When changing ownership, group, or permissions, an attacker could replace the target or one of its parent directories with a symlink. The next time opentmpfiles ran, it could follow the attacker-controlled symlink.
About the research
The disclosure was published under CVE-2017-18925 so system maintainers could track the vulnerability and remediation consistently.