git: 880df4f46550 - main - security/vuxml: mark seatd 0.6.[0-3] as vulnerable
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 21 Feb 2022 23:02:04 UTC
The branch main has been updated by jbeich:
URL: https://cgit.FreeBSD.org/ports/commit/?id=880df4f46550cda720afecab5db96da18dbbc851
commit 880df4f46550cda720afecab5db96da18dbbc851
Author: Jan Beich <jbeich@FreeBSD.org>
AuthorDate: 2022-02-21 22:59:58 +0000
Commit: Jan Beich <jbeich@FreeBSD.org>
CommitDate: 2022-02-21 22:59:58 +0000
security/vuxml: mark seatd 0.6.[0-3] as vulnerable
---
security/vuxml/vuln-2022.xml | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index 68050ed2428b..cf8aeb1457b1 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,40 @@
+ <vuln vid="1cd565da-455e-41b7-a5b9-86ad8e81e33e">
+ <topic>seatd-launch -- remove files with escalated privileges with SUID</topic>
+ <affects>
+ <package>
+ <name>seatd</name>
+ <range><ge>0.6.0</ge><lt>0.6.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Kenny Levinsen reports:</p>
+ <blockquote cite="https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E">
+ <p>seatd-launch could use a user-specified socket path instead of the
+ internally generated socket path, and would unlink the socket path
+ before use to guard against collision with leftover sockets. This
+ meant that a caller could freely control what file path would be
+ unlinked and replaced with a user-owned seatd socket for the duration
+ of the session.</p>
+ <p>If seatd-launch had the SUID bit set, this could be used by a
+ malicious user to remove files with the privileges of the owner of
+ seatd-launch, which is likely root, and replace it with a user-owned
+ domain socket.</p>
+ <p>This does not directly allow retrieving the contents of existing
+ files, and the user-owned socket file is at the current time not
+ believed to be directly useful for further exploitation.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E</url>
+ </references>
+ <dates>
+ <discovery>2022-02-21</discovery>
+ <entry>2022-02-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="43ae57f6-92ab-11ec-81b4-2cf05d620ecc">
<topic>Qt5 -- QProcess unexpected search path</topic>
<affects>