Race Condition in sblim-sfcb Leads to Privilege Escalation

Executive Summary

This is a race condition flaw in sblim-sfcb where a local low-privileged attacker manipulates a temporary file in /tmp during privileged instance migration. By repeatedly recreating a symbolic link, the attacker redirects privileged output to an arbitrary file, causing corruption or denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of sblim-sfcb and verifying if instance migration is enabled. Inspect the sfcbrepos command usage and temporary file handling in /tmp. Look for symlink manipulation attempts in /tmp/sfcbinst.mof during privileged operations.

Useful 0 Not Useful 0

Impact Analysis

It allows a local attacker to corrupt privileged files or cause a system denial of service. Exploitation requires specific conditions like a local user, enabled instance migration, and ability to recreate symlinks in /tmp. Impact is limited to integrity and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts integrity and availability through local file corruption or denial of service. It does not directly affect confidentiality or data exposure, which are key concerns for GDPR and HIPAA. Compliance risks would arise if the DoS disrupts critical services handling sensitive data, but the local attack vector and specific conditions limit broader regulatory impact.

Useful 0 Not Useful 0

Mitigation Strategies

Disable instance migration by running sfcbrepos with the -i flag: sudo sfcbrepos -f -i. Avoid running sfcbrepos with elevated privileges if untrusted users can write to /tmp. Restart or reload the service if sfcbrepos is managed by one.

Useful 0 Not Useful 0