Bug 988498 (CVE-2013-4169)
Summary: | CVE-2013-4169 gdm: TOCTTOU race condition on /tmp/.X11-unix | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> | ||||||
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
Status: | CLOSED ERRATA | QA Contact: | |||||||
Severity: | high | Docs Contact: | |||||||
Priority: | high | ||||||||
Version: | unspecified | CC: | ajax, jkurik, jrusnack, lnykryn, notting, rstrode, security-response-team | ||||||
Target Milestone: | --- | Keywords: | Security | ||||||
Target Release: | --- | ||||||||
Hardware: | All | ||||||||
OS: | Linux | ||||||||
Whiteboard: | |||||||||
Fixed In Version: | gdm 2.21.1 | Doc Type: | Bug Fix | ||||||
Doc Text: | Story Points: | --- | |||||||
Clone Of: | Environment: | ||||||||
Last Closed: | 2013-09-05 21:52:33 UTC | Type: | --- | ||||||
Regression: | --- | Mount Type: | --- | ||||||
Documentation: | --- | CRM: | |||||||
Verified Versions: | Category: | --- | |||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||
Embargoed: | |||||||||
Bug Depends On: | 997619, 997620, 997622, 997624 | ||||||||
Bug Blocks: | 988499 | ||||||||
Attachments: |
|
Description
Vincent Danen
2013-07-25 17:37:47 UTC
One possible solution is to prevent GDM from ever creating this directory by pre-creating it in /etc/rc.sysinit (like we do for /tmp/.ICE-unix). That or simply don't remove it when we boot; in /etc/rc.sysinit we remove /tmp/.X*unix on line 882; we also remove /tmp/.ICE-unix but recreate it correctly later on (line 887). That would involve patching initscripts rather than gdm though. Thoughts? Statement: This flaw only affected GDM in Red Hat Enterprise Linux 5 and does not affect Red Hat Enterprise Linux 6. This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:1213 https://rhn.redhat.com/errata/RHSA-2013-1213.html Created attachment 794934 [details]
patch for gdm
This is the patch to remove the bits that created /tmp/.X11-unix.
Created attachment 794935 [details]
patch for initscripts
This is the patch to create /tmp/.X11-unix at boot.
|