Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22174-1

Опубликовано: 27 окт. 2026
Источник: suse-cvrf

Описание

Security update for gvfs

This update for gvfs fixes the following issue:

  • CVE-2026-88924: gvfs-admin socket ownership race condition allows local users to change the ownership of root-owned files and achieve local privilege escalation (bsc#1280058).

Список пакетов

openSUSE Leap 16.0
gvfs-1.59.90-160000.4.1
gvfs-backend-afc-1.59.90-160000.4.1
gvfs-backend-goa-1.59.90-160000.4.1
gvfs-backend-gphoto-1.59.90-160000.4.1
gvfs-backend-samba-1.59.90-160000.4.1
gvfs-backends-1.59.90-160000.4.1
gvfs-fuse-1.59.90-160000.4.1
gvfs-lang-1.59.90-160000.4.1

Ссылки

Описание

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Затронутые продукты
openSUSE Leap 16.0:gvfs-1.59.90-160000.4.1
openSUSE Leap 16.0:gvfs-backend-afc-1.59.90-160000.4.1
openSUSE Leap 16.0:gvfs-backend-goa-1.59.90-160000.4.1
openSUSE Leap 16.0:gvfs-backend-gphoto-1.59.90-160000.4.1
Ссылки