AI_ONLY_REPORT
package: sblim-cmpi-base-1.6.4-30.el10
------
Summary: Insecure temporary file creation in world-writable directories  
allows symlink overwrite: predictable temporary filenames in provider  
registration scripts let a local attacker redirect privileged writes into  
an attacker-chosen file during registration.
Requirements to exploit: A local unprivileged user must be able to create a  
symlink in `/var/tmp` or `/tmp`, and `provider-register.sh` must be run in  
a privileged context such as RPM `%pre`, `%post`, or `%preun`, or invoked  
manually as root with a vulnerable registration mode. Exploitability is  
reduced or blocked on systems enforcing sticky-directory symlink  
protections such as `fs.protected_symlinks=1`.
Component affected: `sblim-cmpi-base` provider registration scripts  
`provider-register.sh` and `provider-register.sh.pegasus-interop`;  
strongest observed path in `sfcb_install()`/`sfcb_transform()`, with  
similar temporary-file handling in `pegasus_install()` and  
`openwbem_install()`/`openwbem_uninstall()`.
Version affected: `sblim-cmpi-base-1.6.4-30.el10` when the vulnerable  
registration script paths are executed with elevated privileges on systems  
where sticky-directory symlink protections do not prevent the link  
traversal.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H - 6.4 (MEDIUM)
AV:L - Exploitation requires local access to the host.
AC:H - The attacker must hit a privileged registration flow, and  
exploitation may be blocked on modern systems by sticky-directory symlink  
protections or require PID prediction in some code paths.
PR:L - An unprivileged local account is needed to create the symlink in  
a world-writable directory.
UI:N - No separate victim interaction is required once the privileged  
script runs.
S:U - The vulnerable write and the resulting impact stay within the same  
host security scope.
C:N - The demonstrated behavior is file overwrite rather than  
information disclosure.
I:H - A successful attack can modify root-owned files in a privileged  
execution path.
A:H - Overwriting critical files can disrupt services or system  
operation.
Impact: Moderate. On systems without effective sticky-directory symlink  
protections, the flaw can let a local user overwrite root-owned files  
during privileged registration flows. However, exploitation requires local  
access, a privileged execution event, and conditions that are not  
universal. Under Red Hat's guidance, this fits Moderate impact: a flaw that  
could have had Important impact but is less easily exploited based on the  
technical evaluation and/or affects certain configurations.
Embargo: no
Reason: This is a local, configuration-dependent issue with  
straightforward mitigation (`mktemp` and safer temporary-file handling),  
and the available evidence does not show a remote or default-path  
compromise scenario.
Acknowledgement: Aisle Research
Vulnerability Details: The provider registration scripts create temporary  
output files in `/var/tmp` or `/tmp` using predictable names and then write  
through shell redirections that follow symlinks. The clearest path is the  
`sfcb` mode, where `baseregname` is derived from the registration filename  
and used directly in the temporary path:
```sh
for _TEMPDIR in /var/tmp /tmp
do
if test -w $_TEMPDIR
then
_REGFILENAME=$_TEMPDIR/$baseregname.reg
break
fi
done
trap "rm -f $_REGFILENAME" EXIT
if sfcb_transform $_REGFILENAME $myregs
```
```sh
cat >> $OUTFILE <<EOFC
```
A registration input such as `Linux_Base.registration` therefore leads to a  
predictable path such as `/var/tmp/Linux_Base.reg`. The package spec files  
invoke `provider-register.sh` during `%pre`, `%post`, and `%preun`, so  
vulnerable registration modes can run in a privileged package-management  
context. In a controlled proof of concept, pre-creating  
`/var/tmp/Linux_Base.reg` as a symlink caused registration data to be  
written into the symlink target before the downstream staging step failed.  
The `pegasus` and `openwbem` modes use the same insecure  
temporary-directory pattern with PID-based names (`$$.mof`); in `openwbem`,  
the script removes the output path before rewriting it, so that path may  
require tighter timing than the pre-created-symlink `sfcb` case. This  
pattern is consistent with `CWE-377` and `CWE-59`.
Steps to reproduce:
1. On a system where `provider-register.sh` can run as root, ensure  
sticky-directory symlink protections do not block the test case; otherwise  
the issue may not reproduce.
2. As an unprivileged local user, create `/var/tmp/Linux_Base.reg` as a  
symlink to a disposable root-owned file.
3. Trigger the `sfcb` registration path in a privileged context, for  
example `provider-register.sh -t sfcb -r <registration> -m <mof>` as root,  
or through the equivalent package lifecycle action.
4. Observe that registration content is written to the symlink target  
before the staging step exits.
Mitigation: Until a code fix is shipped, keep sticky-directory symlink  
protections enabled (`fs.protected_symlinks=1` or equivalent), avoid  
running the provider registration script from shared multi-user systems  
where untrusted users can plant entries in `/tmp` or `/var/tmp`, and prefer  
a private root-owned temporary directory if the script must be run manually.
Proposed Fix: Replace predictable temporary filenames with securely created  
files from `mktemp`, keep restrictive permissions, and quote the generated  
path consistently. The following minimal patch addresses the primary  
`pegasus` and `sfcb` cases; the same pattern should also be applied to  
`openwbem_install()`, `openwbem_uninstall()`, and  
`provider-register.sh.pegasus-interop`.
```diff
— a/provider-register.sh
+++ b/provider-register.sh
@@
   for _TEMPDIR in /var/tmp /tmp

   do

     if test -w $_TEMPDIR

     then

         _REGFILENAME=$_TEMPDIR/$$.mof

         break

     fi

   done
+    umask 077
+     
_REGFILENAME="$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof")" ||  
return 1
@@

   trap "rm -f $_REGFILENAME" EXIT
+    trap 'rm -f – "$_REGFILENAME"' EXIT
@@

   if pegasus_transform $_REGFILENAME $myregs
+    if pegasus_transform "$_REGFILENAME" $myregs
@@

   for _TEMPDIR in /var/tmp /tmp

   do

     if test -w $_TEMPDIR

     then

         _REGFILENAME=$_TEMPDIR/$baseregname.reg

         break

     fi

   done
+    umask 077
+     
_REGFILENAME="$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.reg")" ||  
return 1
@@

   if sfcb_transform $_REGFILENAME $myregs
+    if sfcb_transform "$_REGFILENAME" $myregs
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use