Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability
18 Jul. 2007
Summary
XFS is the X Font Server, and is used to render fonts for the X Window System. "init.d" refers to the startup and shutdown scripts used by Linux platforms. At boot and shutdown time, these scripts are run by the init program to start and stop various system services.
Local exploitation of a race condition vulnerability in Red Hat Inc.'s Enterprise Linux init.d XFS script allows an attacker to elevate their privileges to root.
Vulnerable Systems:
* RedHat Enterprise Linux version 4
* Fedora Core 6
* (Other versions may also be affected)
The XFS script is vulnerable to a race condition when it is started by init, or by a system administrator. Specifically, it insecurely changes the file permissions of a temporary file. This allows an attacker to make any file on the system world writable.
Exploitation of this vulnerability results in an attacker gaining root privileges on the affected system.
However, in order to exploit this, it is necessary for either the system to be rebooted, or for the administrator to manually restart the XFS.
