acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | acl-0:2.4.0-1.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | acl-0:2.4.0-1.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | acl-0:2.4.0-1.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | acl-0:2.4.0-1.el9_8 | * |
| Red Hat Discovery 2 | RedHat | discovery/discovery-ui-rhel9:1784821750 | * |
| Red Hat Hardened Images | RedHat | acl-main-2.4.0-0.1.hum1 | * |
| Red Hat Insights proxy 1.5 | RedHat | insights-proxy/insights-proxy-container-rhel9:1786433656 | * |
| Red Hat OpenShift distributed tracing 3.10.2 | RedHat | rhosdt/opentelemetry-collector-rhel9:1785704636 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-kubernetes-rhel9:1784794818 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1784794778 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1784795112 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1784794289 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1784795076 | * |
| Acl | Ubuntu | questing | * |
| Acl | Ubuntu | upstream | * |