Threats tagged 'ghsa-5jj9-v4xp-h5h5'

A race condition vulnerability exists in the cockpit-files package on Red Hat Enterprise Linux 9 and related distributions. A local unprivileged attacker with write access to a parent directory can replace a newly created directory with a symbolic link before the ownership change is applied, redirecting ownership changes to arbitrary files. This can lead to information disclosure or unauthorized modification of sensitive files such as /etc/shadow. Exploitation requires local access, an attacker-writable parent directory, user interaction, and winning a narrow race window. A fix is being developed for actively maintained releases, while some deferred streams will not receive immediate fixes due to moderate severity and exploitation difficulty. Mitigations include avoiding privileged owner-assignment directory creation in writable directories by untrusted users and applying the sticky bit on shared writable directories.