CVE-2021-35938: Rpm Package Manager Privilege Escalation

CVE-2021-35938 Overview

A symbolic link (symlink) vulnerability was discovered in the RPM Package Manager that affects how permissions and credentials are applied during file installation. This race condition flaw allows a local unprivileged user to exploit the timing window between file installation and permission setting to replace the original file with a symbolic link pointing to a security-critical system file.

Critical Impact

Local attackers can exploit this symlink race condition to escalate privileges on the system, potentially gaining root access and compromising data confidentiality, integrity, and system availability.

Affected Products

• RPM Package Manager (all versions prior to fix)
• Fedora 34
• Red Hat Enterprise Linux 7.0, 8.0, and 9.0

Discovery Timeline

• 2022-08-25 - CVE-2021-35938 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-35938

Vulnerability Analysis

This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack. The flaw exists in the RPM package manager's file installation process, where there is a critical timing window between when a file is installed and when its permissions and ownership are subsequently set.

During package installation, RPM creates the target file with certain default permissions, then applies the desired permissions and credentials in a separate operation. An attacker with local access to the system can exploit this Time-of-Check Time-of-Use (TOCTOU) race condition by monitoring the installation process and replacing the newly created file with a symbolic link pointing to a sensitive system file before the permission-setting operation completes.

When RPM then applies the intended permissions to what it believes is the package file, it actually modifies the permissions on the symlink target—potentially a critical system file such as /etc/shadow, /etc/sudoers, or system binaries. This can result in unauthorized access to sensitive data or the ability to execute privileged operations.

Root Cause

The root cause of this vulnerability lies in the non-atomic nature of the file installation and permission-setting operations in RPM. The package manager does not adequately verify that the file it is modifying permissions on is the same file it originally created, nor does it implement proper safeguards against symlink substitution during the vulnerable window.

The fix, as implemented in GitHub RPM Pull Request #1919, addresses this by ensuring proper link resolution and validation before applying file permissions.

Attack Vector

The attack requires local access to the system with the ability to execute code as an unprivileged user. The attacker must:

1. Monitor for RPM package installation activity
2. Identify the target file being installed during the vulnerable timing window
3. Rapidly replace the file with a symbolic link to a security-critical file
4. Wait for RPM to apply permissions to the symlink target

The attack is local in nature, meaning the attacker must already have some level of access to the system. However, successful exploitation can elevate their privileges significantly, potentially to root level.

The vulnerability mechanism involves exploiting the race condition during RPM's file installation process. When a package is installed, RPM first creates the file, then sets permissions in a separate step. An attacker can replace the file with a symlink to a sensitive target (e.g., /etc/shadow) between these operations, causing RPM to inadvertently modify the target file's permissions. Technical details are available in the Red Hat Bugzilla Report.

Detection Methods for CVE-2021-35938

Indicators of Compromise

• Unexpected permission changes on critical system files such as /etc/shadow, /etc/passwd, or /etc/sudoers
• Presence of suspicious symbolic links in directories where RPM packages are being installed
• Unusual local user activity during package installation operations
• Modified timestamps on system-critical files that do not correlate with authorized administrative activity

Detection Strategies

• Monitor file system operations during RPM package installations for symlink creation activity
• Implement file integrity monitoring (FIM) on critical system files to detect unauthorized permission changes
• Configure auditd rules to capture symlink creation events in common package installation directories
• Review system logs for anomalous RPM installation patterns or failures

Monitoring Recommendations

• Enable enhanced audit logging for file operations involving symlink(), chmod(), and chown() system calls
• Deploy endpoint detection and response (EDR) solutions capable of detecting TOCTOU race condition exploitation
• Implement regular file permission audits on critical system files to identify unauthorized changes
• Monitor for privilege escalation attempts following RPM package installations

How to Mitigate CVE-2021-35938

Immediate Actions Required

• Update RPM to version 4.18.0 or later, which contains the fix for this vulnerability
• Apply vendor-specific security patches from Red Hat, Fedora, or other distribution maintainers
• Restrict local user access on systems where RPM package installations are performed
• Implement file integrity monitoring on critical system files as a compensating control

Patch Information

The vulnerability has been addressed in RPM version 4.18.0 and later. The fix is available in GitHub commit 25a435e90844ea98fe5eb7bef22c1aecf3a9c033. Distribution-specific patches are available from:

• Red Hat CVE Advisory
• Gentoo GLSA Advisory
• RPM Release 4.18.0 Information

Organizations should consult their Linux distribution's security advisory channels for specific update instructions.

Workarounds

• Limit RPM package installations to single-user mode or controlled environments where local user activity is restricted
• Implement strict access controls to prevent unprivileged users from executing code during package installation windows
• Use file system mount options such as nosymfollow where supported to prevent symlink traversal
• Consider containerized or isolated environments for package installation operations where feasible

# Configuration example: Enable auditd monitoring for symlink operations
# Add to /etc/audit/rules.d/symlink.rules
-a always,exit -F arch=b64 -S symlink -S symlinkat -k symlink_monitor
-a always,exit -F arch=b32 -S symlink -S symlinkat -k symlink_monitor

# Reload audit rules
auditctl -R /etc/audit/rules.d/symlink.rules