CVE-2005-3321 in Linux
Summary
by MITRE
chkstat in suse linux 9.0 through 10.0 allows local users to modify permissions of files by creating a hardlink to a file from a world-writable directory which can cause the link count to drop to 1 when the file is deleted or replaced which is then modified by chkstat to use weaker permissions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/06/2021
The vulnerability described in CVE-2005-3321 represents a significant privilege escalation risk within the SUSE Linux 9.0 through 10.0 operating system distributions. This flaw specifically targets the chkstat utility, which is responsible for maintaining proper file permissions and ownership during system operations. The vulnerability exploits a fundamental race condition in how chkstat handles file permissions when processing files that are subject to hardlink manipulation by unprivileged users. The issue arises from the improper handling of file metadata during the file replacement process, creating an exploitable window where malicious users can manipulate permission settings through carefully crafted hardlink attacks.
The technical implementation of this vulnerability relies on the specific behavior of the chkstat utility when encountering files that have been replaced or deleted in world-writable directories. When a file is deleted or replaced in such directories, the system's link count mechanism can be manipulated through hardlink creation by local users. This manipulation causes the link count to drop to one, which triggers chkstat to incorrectly interpret the file state and subsequently apply weaker permissions during its processing cycle. The flaw demonstrates a classic case of improper access control and lacks proper validation of file metadata during atomic operations, making it particularly dangerous in multi-user environments.
The operational impact of this vulnerability extends beyond simple permission modification, as it provides local attackers with a method to weaken file protections that could subsequently be exploited for privilege escalation or persistent access. Attackers can leverage this vulnerability to downgrade permissions on critical system files, potentially enabling them to modify or replace system binaries, create backdoors, or gain elevated privileges within the system. The vulnerability affects the core system integrity mechanisms and undermines the security model of the affected SUSE Linux versions, particularly in environments where multiple users share the same system and world-writable directories exist. This type of vulnerability directly relates to CWE-284, which addresses improper access control, and can be mapped to ATT&CK technique T1068, which covers local privilege escalation through system binary manipulation.
The exploitation of this vulnerability requires local user access and knowledge of the specific system directory structure, particularly identifying world-writable directories where the attack can be mounted. The attack vector involves creating a hardlink to a target file in a world-writable directory, then triggering the file replacement process that causes the link count to drop to one, ultimately allowing chkstat to apply weaker permissions. This vulnerability highlights the importance of proper file system permission handling and the need for robust atomic operations in system utilities. The flaw demonstrates a failure in the principle of least privilege and inadequate validation of file metadata during system operations, making it a critical security concern for all affected SUSE Linux installations. System administrators should implement immediate mitigations including updating to patched versions of the affected software, reviewing world-writable directory permissions, and monitoring for unauthorized file modifications in system directories.