CVE-2022-24951 in Eternal Terminal
Summary
by MITRE • 08/16/2022
A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability identified as CVE-2022-24951 represents a critical race condition flaw within Eternal Terminal software prior to version 6.2.0. This issue stems from improper synchronization mechanisms during the initialization and socket creation processes, creating a temporal window where malicious local users can exploit the system. The vulnerability specifically targets the inter-process communication infrastructure that Eternal Terminal utilizes for client-server communication, making it particularly dangerous in environments where multiple users share the same system resources.
The technical implementation of this race condition occurs during the socket creation phase when Eternal Terminal establishes its communication endpoint. When multiple processes attempt to access or create the IPC socket simultaneously, the software fails to properly enforce atomic operations during socket initialization. This allows a local attacker to intercept the socket creation process and manipulate the file descriptor or socket path before legitimate clients can establish connections. The flaw is classified as a CWE-362 race condition vulnerability, where concurrent access to shared resources without proper synchronization leads to unpredictable behavior and potential security breaches. The attack vector requires local system access, making it a privilege escalation vulnerability that can be exploited by users with minimal system privileges.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables persistent surveillance and potential data interception capabilities. Once an attacker successfully hijacks the IPC socket, they can monitor, modify, or redirect all subsequent client connections attempting to communicate with Eternal Terminal services. This creates a persistent backdoor that remains active until the system is rebooted or the vulnerable software is updated. The implications are particularly severe for remote desktop environments where Eternal Terminal is used for secure connections, as attackers can intercept sensitive session data, credentials, or other confidential information transmitted through the compromised communication channel. This vulnerability aligns with ATT&CK technique T1074.001 for data staging and T1566.001 for credential harvesting, as it provides a mechanism for both data interception and potential credential compromise.
Mitigation strategies for CVE-2022-24951 require immediate software updates to version 6.2.0 or later, which includes proper synchronization mechanisms and atomic socket creation procedures. System administrators should implement comprehensive monitoring of IPC socket creation events and establish baseline behaviors for normal operation. Additional protective measures include restricting local user access to systems running Eternal Terminal, implementing proper file system permissions for socket directories, and deploying intrusion detection systems that can identify suspicious socket manipulation activities. Organizations should also consider network segmentation to limit the potential impact of successful exploitation and maintain regular patching schedules for all remote access software. The vulnerability demonstrates the importance of proper concurrency control in security-critical applications and highlights the need for thorough testing of multi-threaded and multi-process scenarios in software development lifecycle processes.