CVE-2026-73585

Summary

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-377: Insecure Temporary File

Workarounds

To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running sysctl -w fs.protected_symlinks=1. To make this change persistent across reboots, create or modify a file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/99-sysctl.conf) with the content fs.protected_symlinks=1 and then run sysctl --system. Additionally, avoid running the sblim-cmpi-base provider registration scripts from shared multi-user systems where untrusted users can create symlinks in /tmp or /var/tmp. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.

References