Impact
Temporary data is written to a local locations accessible by all users for the host for the Budgie Extras WeatherShow applet.
The data file format is easily guessable; this potentially allows another user to present false information to the other user or could be used as an attack vector to deny access to the application through manipulation of files in this accessible file location.
Key issues:
- Data is monitored and can be displayed in the applet listbox. Ths can confuse a users GUI.
- Data can be manipulated by another user controlling whether to display or close a popup dialog. This can confuse a users GUI.
- By placing a FIFO the popup could be subject to denial-of-service
(either by blocking it indefinitely or by feeding it large amounts of
data, leading to an out-of-memory situation).
Without the Linux kernel's symlink protection it can be used to read from arbitrary files, or to operate in
arbitrary directories.
-
By placing a file in the host location, the existence check by the shuffler daemon will never trigger and thus any user rules will not run. This can confuse the users GUI.
-
By placing a file is a known location this can control the display or closing of the shuffler grid-window and thereby confusing the Users GUI.
-
The warning image is created programmatically.
A local attacker can attempt to place arbitrary PNG data in this path
and have it displayed on the victim's desktop.
- Data in a file is evaluated; there is a chance for a local attacker to massively break the
layout logic or maybe even achieve code execution. The
Linux kernel's protected_regular sysctl setting comes to the rescue
here, though. The open() with O_CREAT will fail. It can then
still present a denial-of-service vector, though.
Patches
The fix has been resolved in a patch release v1.7.1
Workarounds
This issue can be mitigated if there is only one user account on the system and limiting physical access to other users to the host system.
References
None.
mgerstner Reporter
eslerm Sponsor
samlane-ma Analyst
fossfreedom Remediation verifier
Impact
Temporary data is written to a local locations accessible by all users for the host for the Budgie Extras WeatherShow applet.
The data file format is easily guessable; this potentially allows another user to present false information to the other user or could be used as an attack vector to deny access to the application through manipulation of files in this accessible file location.
Key issues:
(either by blocking it indefinitely or by feeding it large amounts of
data, leading to an out-of-memory situation).
Without the Linux kernel's symlink protection it can be used to read from arbitrary files, or to operate in
arbitrary directories.
By placing a file in the host location, the existence check by the shuffler daemon will never trigger and thus any user rules will not run. This can confuse the users GUI.
By placing a file is a known location this can control the display or closing of the shuffler grid-window and thereby confusing the Users GUI.
The warning image is created programmatically.
A local attacker can attempt to place arbitrary PNG data in this path
and have it displayed on the victim's desktop.
layout logic or maybe even achieve code execution. The
Linux kernel's protected_regular sysctl setting comes to the rescue
here, though. The
open()withO_CREATwill fail. It can thenstill present a denial-of-service vector, though.
Patches
The fix has been resolved in a patch release v1.7.1
Workarounds
This issue can be mitigated if there is only one user account on the system and limiting physical access to other users to the host system.
References
None.