Description

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing. The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T08:16:51.503Z",
  "pubdate": "2026-08-28T08:16:51.503Z",
  "executiveSummary": "The vulnerability identified in the Intel Speed Select daemon is a symlink-based race condition occurring during pidfile creation. This flaw allows a local, unprivileged attacker to perform a symlink attack by pre-creating a symbolic link at a fixed location in /tmp before the daemon, running with elevated privileges (root), initializes.\nBy manipulating the pidfile path, the attacker can force the root-privileged process to overwrite arbitrary files on the filesystem. This can lead to privilege escalation, system instability, or denial-of-service conditions depending on the target file selected by the attacker. The vulnerability stems from insecure file handling practices where the daemon fails to verify the integrity and nature of the target file prior to opening it.\nSuccessful exploitation requires local access to the system and the ability to race the daemon's startup process. Because the target path is in a globally writable directory (/tmp), the attack vector is accessible to any local user. Remediation involves implementing secure file opening flags and post-open validation to ensure the file descriptor refers to an expected file rather than a symbolic link.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of pidfile creation within the intel-speed-select tool's daemon mode. The application historically attempted to open a pidfile at a predictable, fixed path within the /tmp directory without verifying whether the path destination was a symbolic link or an existing file.\nIn a Linux environment, /tmp is world-writable, allowing any local unprivileged user to create files or symbolic links within that directory. The attack flow is as follows: 1) An attacker identifies the predictable path used by the intel-speed-select daemon for its pidfile. 2) The attacker creates a symbolic link at this location pointing to a sensitive file on the system (e.g., /etc/shadow or a critical configuration file). 3) When the intel-speed-select daemon starts as root, it attempts to open the pidfile for writing. 4) Because the daemon fails to check for symlinks, it follows the attacker-created link, opening the target file instead of the intended pidfile. 5) The daemon subsequently writes its process ID or other data into the target file, resulting in file corruption or privilege escalation through unintended configuration modification.\nThis behavior constitutes a classic TOCTOU (Time-of-Check to Time-of-Use) or symlink race condition. The vulnerability component is the file open logic within the daemon's initialization routine. The current fix addresses this by modifying the open call to include the O_NOFOLLOW flag, which prevents the open operation from succeeding if the target path is a symbolic link. Furthermore, the fix implements an fstat() call on the resulting file descriptor. This validation step ensures that the file being opened is a regular file and not a malicious link or a device file, adding a secondary layer of defense to the locking and writing process.\nThe attack requires local execution capabilities and does not involve network exposure, as it relies on the local filesystem structure and the predictable nature of the daemon's runtime path. Privilege requirements for the attacker are minimal (unprivileged local user), while the impact of successful exploitation is significant due to the daemon's requirement for root privileges. Post-exploitation, the attacker may gain control over system files, potentially leading to a full compromise of the system's integrity."
}