CVE-2012-0871
published 2014-04-18CVE-2012-0871: The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite…
PriorityP420medium6.3CVSS 2.0
AVLACMAuNCNICAC
EPSS
0.36%
28.1th percentile
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | systemd | < systemd 43-1 (bookworm) | systemd 43-1 (bookworm) |
| opensuse | opensuse | — | — |
| systemd_project | systemd | <= 037 | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
CVSS provenance
nvdv2.06.3MEDIUMAV:L/AC:M/Au:N/C:N/I:C/A:C
osv6.3MEDIUM
vendor_debian6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2012-0871: systemd - The session_link_x11_socket function in login/logind-session.c in systemd-logind...
vendor_debian·2012·CVSS 6.3
CVE-2012-0871 [MEDIUM] CVE-2012-0871: systemd - The session_link_x11_socket function in login/logind-session.c in systemd-logind...
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
Scope: local
bookworm: resolved (fixed in 43-1)
bullseye: resolved (fixed in 43-1)
forky: resolved (fixed in 43-1)
sid: resolved (fixed in 43-1)
trixie: resolved (fixed in 43-1)
GHSA
GHSA-jv9q-v37q-34vv: The session_link_x11_socket function in login/logind-session
ghsa_unreviewed·2022-05-13
CVE-2012-0871 [MEDIUM] CWE-59 GHSA-jv9q-v37q-34vv: The session_link_x11_socket function in login/logind-session
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
OSV
CVE-2012-0871: The session_link_x11_socket function in login/logind-session
osv·2014-04-18·CVSS 6.3
CVE-2012-0871 [MEDIUM] CVE-2012-0871: The session_link_x11_socket function in login/logind-session
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges [fedora-all]
bugzilla·2012-03-01·CVSS 6.3
CVE-2012-0871 [MEDIUM] CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges [fedora-all]
CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/
Bugzilla
CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges
bugzilla·2012-02-21·CVSS 6.3
CVE-2012-0871 [MEDIUM] CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges
CVE-2012-0871 systemd: insecure file creation may lead to elevated privileges
Sebastian Krahmer of the SUSE Security Team reported that systemd-logind, a part of the systemd service and system manager, did not create certain special files in a secure way. systemd-logind is responsible for managing and tracking user login sessions, and if a user were to log into the X11 desktop, it creates entries in /run/user/[username]/X11, where /run/user/[username] is a user-owned directory. Because systemd-logind does not create the entries in a secure fashion, a malicious user could replace /run/user/[username]/X11 with a symlink to another root-owned directory, such as /etc/pam.d or /etc/cron.d. This would cause a symlink named "display" to be created in the target directory, which is a symlink to a
http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7chttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.htmlhttp://www.osvdb.org/79768https://bugzilla.novell.com/show_bug.cgi?id=747154https://bugzilla.redhat.com/show_bug.cgi?id=795853http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7chttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.htmlhttp://www.osvdb.org/79768https://bugzilla.novell.com/show_bug.cgi?id=747154https://bugzilla.redhat.com/show_bug.cgi?id=795853
2014-04-18
Published