CyberRota Analysis
AI-GeneratedThe vulnerability affects the gvfs admin backend, specifically the gvfsd-admin daemon, which improperly handles ownership changes of D-Bus sockets due to a Time-of-Check Time-of-Use (TOCTOU) race condition. An authenticated local attacker can exploit this flaw to escalate privileges to root by manipulating socket pathnames, potentially allowing them to modify critical system files. Organizations using Exchange should prioritize patching this vulnerability to mitigate the risk of local privilege escalation attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.