CVE-2024-54159 is a vulnerability identified in stalld, a daemon used in Linux environments, present through version 1.19.7. The flaw arises from insecure handling of the /tmp/rtthrottle file, which can be exploited by a local attacker through a symbolic link (symlink) attack. By creating a malicious symlink at /tmp/rtthrottle pointing to an arbitrary file, an attacker can cause stalld to overwrite that file, resulting in a denial of service (DoS) condition. This vulnerability is classified under CWE-732, which involves incorrect permissions or access control on critical files. The attack requires local access and user interaction, with a high attack complexity, meaning it is not trivial to exploit. The CVSS v3.1 score is 4.1 (medium severity), reflecting limited impact on confidentiality and integrity but moderate impact on availability. No privilege escalation is needed, but the attacker must have local user rights. There are no patches or known exploits publicly available at this time. The vulnerability’s scope is limited to systems running the affected stalld versions, typically Linux servers or devices using this daemon for resource throttling.

The primary impact of CVE-2024-54159 is denial of service through file overwrite, which can disrupt the normal operation of stalld and potentially other system components if critical files are overwritten. This can lead to service outages or degraded performance, affecting availability. Since the attack requires local access, the risk is limited to environments where untrusted users have shell or user-level access. The vulnerability does not directly compromise confidentiality or integrity of data but may indirectly affect system stability and reliability. Organizations relying on stalld for resource management in multi-user or shared environments may experience interruptions, impacting operational continuity. The absence of known exploits reduces immediate risk, but the vulnerability could be leveraged in targeted attacks or combined with other exploits. Systems without proper file permission controls or with lax local user restrictions are at higher risk.

To mitigate CVE-2024-54159, organizations should implement the following specific measures: 1) Restrict local user permissions to prevent unauthorized creation of symlinks in /tmp or other temporary directories; 2) Employ filesystem protections such as mounting /tmp with the 'noexec', 'nodev', and 'nosuid' options and consider using 'sticky bit' permissions to prevent symlink abuse; 3) Monitor and audit /tmp directory for suspicious symlink creation or modifications; 4) Apply any available patches or updates from stalld maintainers promptly once released; 5) Consider running stalld with the least privileges necessary and in a confined environment (e.g., containers or sandboxing) to limit impact; 6) Educate system administrators about the risks of symlink attacks and enforce strict local user access policies; 7) Use security tools that detect and prevent symlink race conditions or attacks. These targeted steps go beyond generic advice by focusing on the specific attack vector and environment of stalld.