CVE-2012-0871 in systemd
Summary
by MITRE
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/11/2026
The vulnerability described in CVE-2012-0871 represents a critical local privilege escalation issue within the systemd-logind component of the systemd suite. This flaw exists in the session_link_x11_socket function located in login/logind-session.c, affecting systemd versions 37 and earlier. The vulnerability stems from improper handling of symbolic links during the creation of X11 socket files, creating a race condition that can be exploited by local attackers to manipulate the filesystem in unintended ways. The attack vector specifically targets the X11 user directory located in the /run/user/ filesystem hierarchy, which is a temporary filesystem typically mounted with restricted permissions but still accessible to local users.
The technical implementation of this vulnerability involves a classic symlink attack pattern where an attacker can manipulate the symbolic link resolution process during socket file creation. When systemd-logind attempts to create X11 socket files in the /run/user/ directory, it does not properly validate or secure the symbolic link resolution process. This allows a local user to establish a malicious symbolic link that points to a target file outside the intended directory structure. The flaw is particularly dangerous because it operates within the context of a system service that has elevated privileges, enabling the attacker to potentially overwrite or create files with permissions that exceed normal user capabilities. The vulnerability maps directly to CWE-59, which describes improper link resolution without limit checks, and also relates to CWE-22, which covers improper limitation of a pathname to a restricted directory.
The operational impact of this vulnerability extends beyond simple file manipulation, as it can be leveraged for privilege escalation and persistent access to system resources. Attackers can exploit this flaw to create files in locations where they normally would not have write permissions, potentially allowing them to inject malicious code into system processes or modify critical configuration files. The attack typically involves creating a symbolic link in the X11 user directory that points to a system file or directory, then triggering the vulnerable function to create or overwrite the target file. This technique can be particularly effective in multi-user environments where systemd-logind services are running with elevated privileges. The vulnerability also aligns with ATT&CK technique T1059.007, which covers command and scripting interpreter usage, and T1548.001, which covers abuse of sudo privileges, as the exploitation can lead to privilege escalation.
Mitigation strategies for this vulnerability require immediate patching of affected systemd versions to address the symbolic link handling issue in the session_link_x11_socket function. System administrators should ensure that all systemd components are updated to versions that properly validate symbolic link resolution during socket file creation operations. Additional protective measures include implementing proper file permissions and access controls within the /run/user/ filesystem, using file system capabilities to restrict symbolic link creation in sensitive directories, and monitoring for suspicious file creation patterns in the X11 user directory. The vulnerability also highlights the importance of proper input validation and secure coding practices in system services, particularly those operating with elevated privileges. Organizations should also consider implementing automated patch management systems to ensure timely updates of critical system components and conduct regular security assessments of system services to identify similar race condition vulnerabilities.