Bug 745024 (CVE-2011-4029)

Summary:

CVE-2011-4029 xorg-x11-server: lock file chmod change race condition

Product:

[Other] Security Response

Reporter:

Jan Lieskovsky <jlieskov>

Component:

vulnerability

Assignee:

Red Hat Product Security <security-response-team>

Status:

CLOSED ERRATA

QA Contact:

Severity:

low

Docs Contact:

Priority:

low

Version:

unspecified

CC:

ajax, rcvalle, security-response-team, vdanen, xgl-maint

Target Milestone:

---

Keywords:

Security

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2012-06-20 10:23:36 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

799349, 807122

Bug Blocks:

745043, 784298

Attachments:

Description	Flags
Proposed X.Org X11 server upstream patch for CVE-2011-4029 issue	none

Description Jan Lieskovsky 2011-10-11 08:33:36 UTC

A time-of-check, time-of-use (TOCTOU) race condition was found in the way X.Org X11 X server performed management of temporary lock files. After opening the temporary lock file for writing, the X.Org X11 X server did not recheck if the originally opened file still refers to the same file on disc prior relaxing permissions on the file. A local attacker could use this flaw to conduct symlink attacks (involving the X.Org X11 X server temporary lock file instance) and set the read permissions for all users on any file or directory, leading to disclosure of sensitive information.

Note:
For the exploit to succeed the local attacker needs to be able to run the X.Org X11 X server.

Comment 3 Jan Lieskovsky 2011-10-11 09:06:14 UTC

Acknowledgements:

Red Hat would like to thank researcher with a nickname vladz for reporting this issue.

Comment 9 Jan Lieskovsky 2011-10-18 10:56:38 UTC

Created attachment 528781 [details]
Proposed X.Org X11 server upstream patch for CVE-2011-4029 issue

Comment 10 Vincent Danen 2011-10-18 16:43:46 UTC

This issue is now public.  The following commit corrects the problem upstream:

http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4


External References:

http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html

Comment 11 Vincent Danen 2011-10-18 16:44:59 UTC

Statement:

(none)

Comment 14 Jan Lieskovsky 2012-03-02 14:50:23 UTC

This issue affects the current version (xorg-x11-server-Xorg-1.10.4-1.fc15.*) of the xorg-x11-server package, as shipped with Fedora release of 15. Please schedule an update.

--

This issue does NOT affect the current version (xorg-x11-server-Xorg-1.11.4-1.fc16) of the xorg-x11-server package, as shipped with Fedora release of 16. The deficiency in this version is corrected already.

Comment 15 Jan Lieskovsky 2012-03-02 14:55:45 UTC

Created xorg-x11-server tracking bugs for this issue

Affects: fedora-15 [bug 799349]

Comment 17 errata-xmlrpc 2012-06-20 07:27:16 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0939 https://rhn.redhat.com/errata/RHSA-2012-0939.html