It was found that kwallet-pam was doing file writing and permission changing as root that with correct timing and use of carefully crafted symbolic links could allow a non privileged user to become the owner of any file on the system. External References: https://www.kde.org/info/security/advisory-20180503-1.txt Upstream patches: https://commits.kde.org/kwallet-pam/2134dec85ce19d6378d03cddfae9e5e464cb24c0 https://commits.kde.org/kwallet-pam/01d4143fda5bddb6dca37b23304dc239a5fb38b5
Created pam-kwallet tracking bugs for this issue: Affects: epel-7 [bug 1574853]
pam-kwallet-5.12.5-3.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
pam-kwallet-5.12.5-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.