Hardened pidfile handling in Intel Speed Select Linux kernel tool

Executive Summary

This vulnerability involves a symlink-based attack in the Linux kernel's Intel Speed Select tool. A local unprivileged user can create a symlink at a fixed pidfile path under /tmp, causing a root-run daemon to write to an attacker-chosen file instead. The issue is mitigated by hardening the daemon to open the pidfile with O_NOFOLLOW and validate it with fstat() before operations.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected files or symlinks in /tmp related to intel-speed-select. Inspect running processes for the daemon and verify pidfile handling. Commands: ls -la /tmp | grep intel-speed-select, ps aux | grep intel-speed-select, lsof | grep /tmp/intel-speed-select.pid

Review system logs for unauthorized file writes or symlink operations near /tmp/intel-speed-select.pid. Use journalctl or dmesg for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow a local attacker to overwrite critical system files or escalate privileges by tricking the root-run daemon into writing to unintended locations. This may lead to denial of service, data corruption, or further system compromise depending on the daemon's functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves symlink-based pidfile clobbering in the Linux kernel's Intel Speed Select tool, allowing a local unprivileged user to manipulate file writes. It does not directly impact GDPR or HIPAA compliance as it is a local privilege escalation issue rather than a data exposure or privacy violation.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to the patched version. Remove any existing symlinks at /tmp/intel-speed-select.pid. Restrict write permissions to /tmp for unprivileged users if possible.

Monitor for unusual file creation in /tmp and restart the intel-speed-select daemon after applying updates.

Useful 0 Not Useful 0