Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

Overview

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

Affected

• sblim-cmpi-base (all versions)
• sblim-cmpi-base
• sblim-cmpi-base (all versions)
• sblim-cmpi-base (all versions)
• sblim-cmpi-base (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running sysctl -w fs.protected_symlinks=1. To make this change persistent across reboots, create or modify a file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/99-sysctl.conf) with the content fs.protected_symlinks=1 and then run sysctl --system. Additionally, avoid running the sblim-cmpi-base provider registration scripts from shared multi-user systems where untrusted users can create symlinks in /tmp or /var/tmp. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.