Description
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
vifm vifm
Default version status: unaffected
0.8.1-beta to ≤ 0.14.4affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg ↗
- https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L394-L443 ↗
- https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L866-L874 ↗
- https://github.com/vifm/vifm/releases/tag/v0.14.4 ↗
- https://www.vulncheck.com/advisories/vifm-0.8.1-beta-through-0.14.4-unverified-ipc-fifo-ownership-allows-cross-user-command-execution ↗