CVE-2026-73584: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-73584 is an insecure temporary file vulnerability (symlink race / TOCTOU) in sblim-sfcb, a Small Footprint CIM Broker used on Linux systems. A local, low-privileged attacker can exploit a race condition in the sfcbrepos script during privileged instance migration to redirect privileged file writes to an arbitrary file via a symbolic link placed in /tmp. The flaw was reported on 2026-04-26, disclosed publicly on 2026-08-13, and affects sblim-sfcb-1.4.9-36.el10 (Red Hat Enterprise Linux 10). It carries a CVSS v3.1 base score of 6.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-377 (Insecure Temporary File). The sfcbrepos shell script uses a fixed, predictable pathname (/tmp/sfcbinst.mof) in the world-writable /tmp directory: it explicitly removes the file with rm -f and then passes the same path to sfcbinst2mof -o, which reopens it via fopen() in append mode. This unlink-then-reopen pattern creates a TOCTOU race window during which a local attacker can repeatedly recreate /tmp/sfcbinst.mof as a symbolic link pointing to an arbitrary target file (e.g., /etc/shadow). Exploitation requires: a local low-privileged account, a privileged sfcbrepos execution with instance migration enabled (no -i flag), and a repository.previous/<namespace>/ directory containing at least one static instance file so the vulnerable sfcbinst2mof -o code path executes. The proposed fix replaces the fixed path with mktemp-generated secure temporary files and adds a trap-based cleanup (Red Hat Bugzilla).

Successful exploitation allows a local attacker to append arbitrary MOF-formatted content to any file writable by the privileged sfcbrepos process, leading to privileged file corruption (integrity impact: High) or denial of service (availability impact: High) by corrupting critical system files or service configurations. There is no confidentiality impact, as the flaw enables writes rather than reads. The scope is limited to the local system; lateral movement is not directly facilitated, but corruption of files such as /etc/shadow or service configuration files could destabilize the host or enable further privilege escalation (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity required to win the race condition. The EPSS score is approximately 0.091%, indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires specific preconditions: local access, a privileged sfcbrepos run with migration enabled, and qualifying repository content (Red Hat CVE).

1. Reconnaissance: Confirm the target system runs sblim-sfcb (e.g., rpm -q sblim-sfcb) and that instance migration is enabled (i.e., sfcbrepos is not invoked with -i). Verify that repository.previous/<namespace>/ contains at least one static instance file.
2. Prepare symlink loop: From an unprivileged local account, start a background loop that continuously recreates /tmp/sfcbinst.mof as a symlink to the target file (e.g., a disposable file for testing, or a privileged file for actual attack):

   while true; do ln -sfn /target/file /tmp/sfcbinst.mof; done

3. Trigger privileged execution: Wait for or trigger a privileged sfcbrepos -f execution (e.g., during package install/update of the sblim-sfcb-schema subpackage, which calls sfcbrepos -f from its %post scriptlet, or manually via sudo sfcbrepos -f).
4. Win the race: The script executes rm -f /tmp/sfcbinst.mof then calls sfcbinst2mof -o /tmp/sfcbinst.mof. If the attacker's symlink loop recreates the symlink in the window between rm -f and fopen(), the privileged process opens and appends MOF output to the symlink target.
5. Achieve impact: The target file is appended with MOF content by the privileged process, causing corruption or denial of service. Repeat privileged rebuilds as needed until the race is won (Red Hat Bugzilla).

• File System: Unexpected symbolic link at /tmp/sfcbinst.mof pointing to a file outside /tmp; MOF-formatted content appended to unexpected system files (e.g., /etc/shadow, service config files); presence of a rapidly cycling symlink creation script in user home or /tmp.
• Process: Multiple rapid ln -sfn invocations targeting /tmp/sfcbinst.mof visible in process listings or audit logs; sfcbinst2mof process writing to a file path other than a legitimate temporary file.
• Logs: Audit log entries (auditd) showing open() or fopen() calls by a privileged process on a symlink in /tmp that resolves outside /tmp; SELinux/AppArmor denials related to sfcbinst2mof writing to unexpected paths; repeated rm and ln operations on /tmp/sfcbinst.mof in short succession (Red Hat Bugzilla).

Workaround (immediate): If instance migration is not required, run sfcbrepos with the -i flag to disable the vulnerable migration path: sudo sfcbrepos -f -i. Additionally, avoid running sfcbrepos with elevated privileges on systems where untrusted local users can concurrently write to /tmp. A service restart may be required after configuration changes. Patch: The proposed fix replaces the fixed /tmp/sfcbinst.mof path with a mktemp-generated secure temporary file, sets permissions to 600, and uses a trap for cleanup — eliminating the TOCTOU window. Monitor Red Hat advisories for an official patched package release (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process. Red Hat classified the impact as Moderate, noting that the high attack complexity and specific preconditions (local access, active migration path, qualifying repository content) limit broader impact. No significant public researcher commentary or media coverage has been identified beyond the Red Hat advisory and Bugzilla report (Red Hat CVE).