GDM TOCTTOU race condition on /tmp/.X11-unix (CVE-2013-4169)

[Vincent Danen <vdanen () redhat com>]

As per the distros@ list recommendations, I'm writing to alert of a
problem with older versions of GDM.  As per our bugzilla [1]:

Vladz reported that GDM versions < 2.21.1 were vulnerable to a TOCTTOU
(time of check to time of use) flaw in the way that GDM checked for the
existence of, and created if missing, the /tmp/.X11-unix/ special
directory.  A local attacker could use this flaw to overwrite arbitrary
file contents via symbolic link attacks or to manipulate the contents of
arbitrary files, including those files owned by the root user that would
normally be inaccessible.  This is because GDM will chown /tmp/.X11-unix
to the user and group root, but also changes the permissions to 1777.

Newer versions of GDM no longer create the /tmp/.X11-unix/ directory and
are thus not vulnerable to this flaw.

This issue was assigned CVE-2013-4169.  We fixed the problem by having
rc.sysinit pre-create /tmp/.X11-unix at boot, like it does for
/tmp/.ICE-unix (and removing the offending code from GDM).


[1] https://bugzilla.redhat.com/show_bug.cgi?id=988498

--
Vincent Danen / Red Hat Security Response Team