Bug 1197465 (CVE-2022-27816) - AUDIT-FIND: CVE-2022-27816: swhkd: The Unprivileged Server Process Uses a Fixed Temporary File in /tmp/swhks.pid
Summary: AUDIT-FIND: CVE-2022-27816: swhkd: The Unprivileged Server Process Uses a Fix...
Status: RESOLVED FIXED
Alias: CVE-2022-27816
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Aakash Sen Sharma
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 1196890
  Show dependency tree / graph
 
Reported: 2022-03-24 09:32 UTC by Matthias Gerstner
Modified: 2022-04-14 08:56 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2022-03-24 09:32:38 UTC 
+++ This bug was initially created as a clone of Bug #1196890

This is to track parent bug issue 2.f):
   
   ## 2.f) The Unprivileged Server Process Uses a Fixed Temporary File in /tmp/swhks.pid

   Similar to 2.a). Consequences:

   - local application DoS: if an attacker places the PID of an existing process
     there (e.g. PID 1), other users cannot start the server any more.
   - local user file corruption: if kernel symlink protection is off, then the
     PID file can be a symlink to a private file in the user's home directory
     which will then be overwritten with the PID information.

Suggested Fix:

   ## 3.a) All PID and socket files should be placed in non-public locations:

   - The server PID file and socket belong in `/run/user/$PKEXEC_UID`.
Comment 1 Aakash Sen Sharma 2022-03-25 05:00:31 UTC 
I have patched CVE-2022-27816 in the following commit: https://github.com/waycrate/swhkd/commit/4b8442fef512441c9155186956c767a120c12974

A review from the OpenSuse security team would be really helpful.
Comment 2 Matthias Gerstner 2022-03-25 11:40:36 UTC 
Yes the patch should suffice.
Comment 3 Matthias Gerstner 2022-04-14 08:56:35 UTC 
I consider this finding fixed and will close the bug accordingly.