Headline
CVE-2023-49344: Potential leak of data captured and DoS potential attack for budgie-extras Window Shuffler application
Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
Impact
Temporary data is written to a local locations accessible by all users for the host for the Budgie Extras WeatherShow applet.
The data file format is easily guessable; this potentially allows another user to present false information to the other user or could be used as an attack vector to deny access to the application through manipulation of files in this accessible file location.
Key issues:
- Data is monitored and can be displayed in the applet listbox. Ths can confuse a users GUI.
- Data can be manipulated by another user controlling whether to display or close a popup dialog. This can confuse a users GUI.
- By placing a FIFO the popup could be subject to denial-of-service
(either by blocking it indefinitely or by feeding it large amounts of
data, leading to an out-of-memory situation).
Without the Linux kernel’s symlink protection it can be used to read from arbitrary files, or to operate in
arbitrary directories.
By placing a file in the host location, the existence check by the shuffler daemon will never trigger and thus any user rules will not run. This can confuse the users GUI.
By placing a file is a known location this can control the display or closing of the shuffler grid-window and thereby confusing the Users GUI.
The warning image is created programmatically.
A local attacker can attempt to place arbitrary PNG data in this path
and have it displayed on the victim’s desktop.
- Data in a file is evaluated; there is a chance for a local attacker to massively break the
layout logic or maybe even achieve code execution. The
Linux kernel’s protected_regular sysctl setting comes to the rescue
here, though. The open() with O_CREAT will fail. It can then
still present a denial-of-service vector, though.
Patches
The fix has been resolved in a patch release v1.7.1
Workarounds
This issue can be mitigated if there is only one user account on the system and limiting physical access to other users to the host system.
References
None.
Related news
Ubuntu Security Notice 6556-1 - It was discovered that Budgie Extras incorrectly handled certain temporary file paths. An attacker could possibly use this issue to inject false information or deny access to the application. Matthias Gerstner discovered that Budgie Extras incorrectly handled certain temporary file paths. A local attacker could use this to inject arbitrary PNG data in this path and have it displayed on the victim's desktop or deny access to the application.
Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.