Description

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T13:19:18.907Z",
  "pubdate": "2026-08-13T13:19:18.907Z",
  "executiveSummary": "A vulnerability has been identified in sblim-cmpi-base involving insecure temporary file creation within provider registration scripts. This security flaw permits local, unprivileged users to execute symlink attacks by leveraging predictable temporary file paths inside world-writable directories. When privileged execution contexts trigger these scripts, an attacker can manipulate symlinks to intercept and redirect write operations to arbitrary files on the filesystem. The primary impact of this vulnerability includes the unauthorized overwriting of root-owned system files, which can directly result in system service disruption, denial of service, or operational instability. Exploitation requires local system access, an unprivileged attacker capability, and is strictly conditional upon the execution of the vulnerable registration scripts with elevated privileges. While standard operating system mitigations such as sticky-directory symlink protections may reduce overall exploitability, the core risk remains due to improper temporary file handling routines during provider registration processes in the affected software.",
  "technicalDetails": "The vulnerability resides in the provider registration scripts utilized by sblim-cmpi-base. The root cause of the security issue stems from insecure temporary file creation practices, where temporary files are generated with predictable naming conventions or within world-writable directories without adequate access controls or secure file creation mechanisms (such as secure unique file creation primitives). This implementation flaw exposes the component to race conditions and symbolic link exploitation.\nExploitation requires a local attacker with unprivileged access to the host system. The attack flow proceeds as follows: First, the local attacker identifies the predictable temporary file paths or filenames utilized by the sblim-cmpi-base provider registration scripts. Second, the attacker pre-creates a symbolic link within a world-writable directory, pointing from the anticipated temporary file location to a critical, root-owned target file on the system. Third, the attacker waits for or triggers the execution of the vulnerable registration scripts within a privileged context (e.g., via administrative tooling, package management operations, or system initialization routines).\nUpon script execution, the privileged process attempts to write data to the insecure temporary file path. Due to the pre-existing symbolic link controlled by the attacker, the application follows the symlink and performs the write operation against the arbitrary target file instead of a securely isolated temporary file. This payload behavior results in the unintended truncation or overwrite of the targeted root-owned file.\nThe vulnerable component consists of the provider registration scripts bundled within sblim-cmpi-base. Network exposure is none, as the vulnerability is strictly local. Authentication requirements are limited to local unprivileged shell or system access. Privilege requirements for the exploitation phase involve an unprivileged local user to set up the symlink, while the execution of the trigger mechanism requires elevated privileges. Post-exploitation impact encompasses system service disruption, corruption of critical system configurations, and potential degradation of overall system integrity due to arbitrary file overwriting."
}