CVE-1999-1352 in Linux
Summary
by MITRE
mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability described in CVE-1999-1352 represents a critical flaw in the Linux kernel's handling of symbolic links during device node creation operations. This issue specifically affects the mknod system call implementation in Linux kernel version 2.2, where the system fails to properly validate symbolic link references before creating device nodes. The flaw stems from the kernel's decision to follow symbolic links when processing mknod requests, creating a dangerous condition where unauthorized users can manipulate the target of symbolic links to achieve unintended file system operations. This behavior violates fundamental security principles of file system access control and privilege management.
The technical implementation of this vulnerability exploits the inherent design flaw in the mknod system call's interaction with symbolic links. When a user invokes mknod with a path that resolves to a symbolic link, the kernel follows that link and creates the device node at the target location rather than at the symbolic link itself. This creates a scenario where a local user can manipulate symbolic links to point to sensitive system files or directories, then use mknod to overwrite those targets. The vulnerability is particularly dangerous because it operates within the kernel's privilege context, allowing local users to potentially gain elevated privileges or overwrite critical system files. This issue is classified under CWE-59 as improper link resolution, specifically focusing on the failure to properly handle symbolic links in system calls. The attack vector involves creating a symbolic link that points to a target file, then executing mknod against that link to overwrite the target file, effectively bypassing normal file system permissions and access controls.
The operational impact of CVE-1999-1352 extends beyond simple file overwriting to potentially enable privilege escalation within affected systems. Local attackers can leverage this vulnerability to overwrite system configuration files, binaries, or other critical resources that are protected by standard file permissions. The vulnerability is particularly concerning because it operates at the kernel level, where the security boundaries between user space and kernel space are typically well-defined. When exploited successfully, this vulnerability can allow attackers to modify system files that are normally protected, potentially leading to complete system compromise. The attack requires local access but does not require network connectivity, making it particularly dangerous in environments where local users have access to system resources. This vulnerability directly impacts the principle of least privilege and can be used to circumvent mandatory access controls that are normally enforced by the operating system.
Mitigation strategies for this vulnerability focus on kernel-level patches and system configuration adjustments. The primary solution involves updating to a patched version of the Linux kernel where the mknod system call properly validates symbolic link references and prevents following links during device node creation. System administrators should also implement strict file system permissions and monitor for suspicious symbolic link creation patterns. The implementation of mandatory access controls such as SELinux or AppArmor can provide additional layers of protection by restricting the ability of local users to manipulate symbolic links in sensitive locations. Additionally, regular system auditing should include checks for symbolic links that point to system-critical files, as these represent potential attack vectors for this vulnerability. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques and can be categorized under T1068 for local privilege escalation and T1548 for abuse of elevation privileges. Organizations should also consider implementing system hardening practices that reduce the attack surface and limit the ability of local users to manipulate system resources through symbolic links. The vulnerability demonstrates the importance of proper kernel security design and highlights the critical need for thorough testing of system call implementations under various link resolution scenarios.