Vulnerability Details : CVE-2012-1174
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
Products affected by CVE-2012-1174
- cpe:2.3:o:linux:systemd:43:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-1174
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-1174
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.3
|
LOW | AV:L/AC:M/Au:N/C:N/I:P/A:P |
3.4
|
4.9
|
NIST |
CWE ids for CVE-2012-1174
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1174
-
http://www.openwall.com/lists/oss-security/2012/03/16/21
oss-security - [Notification] CVE-2012-1174 systemd: TOCTOU race condition by removing user session
-
https://bugzilla.redhat.com/show_bug.cgi?id=803358
803358 – (CVE-2012-1174) CVE-2012-1174 systemd (systemd-logind): TOCTOU race condition by removing user session
-
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079075.html
[SECURITY] Fedora 17 Update: systemd-44-6.fc17
-
http://cgit.freedesktop.org/systemd/systemd/commit/?id=5ebff5337594d690b322078c512eb222d34aaa82
systemd/systemd - System and Session ManagerExploit;Patch
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:030
mandriva.com
Jump to