Description

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T13:19:18.673Z",
  "pubdate": "2026-08-13T13:19:18.673Z",
  "executiveSummary": "A race condition vulnerability has been identified in sblim-sfcb, specifically involving insecure temporary file handling during privileged instance migration operations.\nThe flaw allows a local, low-privileged attacker to manipulate temporary files within the /tmp directory to redirect privileged output to arbitrary files on the system.\nThe primary impacts of successful exploitation include privileged file corruption and localized denial of service (DoS).\nThe vulnerability affects the sblim-sfcb product and requires local access with low privileges.\nAttacker capabilities involve the manipulation of symbolic links in a race condition attack vector to target arbitrary file paths.\nThe risk implications center around potential system instability, unauthorized file modification, and compromise of system integrity through insecure file operations.",
  "technicalDetails": "The root cause of the vulnerability lies in an insecure temporary file handling mechanism implemented during privileged instance migration within sblim-sfcb.\nThe vulnerable component interacts with the /tmp directory in a manner that is susceptible to Time-of-Check to Time-of-Use (TOCTOU) race conditions.\nThe attack requires local execution and low privileges, meaning the adversary must already possess shell or execution access to the host operating system, ruling out remote network exposure.\nAuthentication is required locally, but no elevated privileges are necessary to initiate the attack.\nThe exploitation method relies on the predictable creation and manipulation of temporary files during the privileged migration process.\nThe attack flow proceeds as follows: 1) The sblim-sfcb service initiates a privileged instance migration operation that writes data to a temporary file located in the /tmp directory using predictable naming conventions. 2) A local, low-privileged attacker anticipates this file creation or wins the race by rapidly toggling a symbolic link pointing from the expected temporary file path to an arbitrary target file on the system. 3) When the privileged sblim-sfcb process writes output, it follows the attacker-controlled symbolic link instead of safely writing to the intended temporary file.\nThe payload behavior involves the redirection of privileged data streams.\nThe post-exploitation impact includes privileged file corruption, where critical system files or application configurations are overwritten with arbitrary output, potentially leading to system instability, application failure, or a localized denial of service (DoS)."
}