CVE-2026-73585: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-73585 is an insecure temporary file creation vulnerability in sblim-cmpi-base, a set of CMPI (Common Manageability Programming Interface) base providers for Linux systems. The flaw exists in the provider registration scripts (provider-register.sh and provider-register.sh.pegasus-interop), allowing a local unprivileged user to conduct a symlink attack that redirects privileged file writes to arbitrary locations. The affected version is sblim-cmpi-base-1.6.4-30.el10 on Red Hat Enterprise Linux 10. It was reported on April 26, 2026, and publicly disclosed on August 13, 2026, with a CVSS v3.1 base score of 6.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-377 (Insecure Temporary File), with an additional link-following component (CWE-59). The registration scripts (sfcb_install(), sfcb_transform(), pegasus_install(), openwbem_install(), openwbem_uninstall()) construct temporary file paths in world-writable directories (/var/tmp or /tmp) using predictable names derived from the registration filename (e.g., $_TEMPDIR/$baseregname.reg). A local attacker can pre-create a symlink at the predictable path pointing to an arbitrary root-owned file; when the privileged script executes and writes through the shell redirection, it follows the symlink and overwrites the attacker-chosen target. Exploitation requires the registration script to be invoked in a privileged context (e.g., during RPM %pre/%post/%preun lifecycle hooks or manual root execution) and is blocked on systems with fs.protected_symlinks=1 enabled (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local unprivileged attacker to overwrite arbitrary root-owned files on the system, with high integrity and high availability impact but no confidentiality impact. Overwriting critical system files (e.g., configuration files, service scripts) can disrupt or disable system services and operations. The attack is confined to the local host (scope unchanged) and does not enable direct information disclosure or remote lateral movement, but could be chained with other techniques to escalate privileges or cause persistent denial of service (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-73585. The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not automatable. The EPSS score is approximately 0.103%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is conditional on specific system configurations (absence of fs.protected_symlinks=1) and requires a privileged script execution event, significantly limiting the attack surface (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify a target system running sblim-cmpi-base-1.6.4-30.el10 on Red Hat Enterprise Linux 10 without fs.protected_symlinks=1 enabled. Confirm local unprivileged access to the system.
2. Identify target file: Choose a root-owned file to overwrite (e.g., a service configuration file or init script) that will cause maximum disruption or enable privilege escalation.
3. Predict temporary filename: Determine the predictable temporary file path used by the registration script. For the sfcb path, this is $_TEMPDIR/$baseregname.reg (e.g., /var/tmp/<registrationname>.reg); for pegasus, it uses a PID-based name ($$.mof).
4. Plant symlink: As the unprivileged local user, create a symlink at the predicted path pointing to the target file: ln -s /etc/cron.d/malicious /var/tmp/<registrationname>.reg.
5. Trigger privileged execution: Wait for or trigger the provider-register.sh script to run in a privileged context, such as during package installation/removal via RPM lifecycle hooks (rpm -i or rpm -e on the sblim-cmpi-base package).
6. Observe overwrite: The privileged script writes registration content through the shell redirection, following the symlink and overwriting the attacker-chosen target file with controlled content (Red Hat Bugzilla).

• File System: Unexpected symlinks in /tmp or /var/tmp pointing to system files (e.g., /etc/ paths, /root/, service configuration directories); modification timestamps on root-owned files coinciding with package installation or removal events.
• Logs: RPM transaction logs (/var/log/dnf.log, /var/log/rpm) showing installation or removal of sblim-cmpi-base around the time of suspicious file modifications; auditd records showing symlink creation in /tmp or /var/tmp by non-root users followed by privileged writes to unexpected paths.
• Process: Shell processes (sh, bash) spawned during RPM lifecycle hooks writing to unexpected file paths; provider-register.sh execution visible in process audit logs with output redirected to non-standard locations.

The primary mitigation is to enable sticky-directory symlink protections by setting fs.protected_symlinks=1. This can be applied immediately with sysctl -w fs.protected_symlinks=1 and made persistent by adding fs.protected_symlinks=1 to /etc/sysctl.d/99-sysctl.conf and running sysctl --system. Additionally, avoid running sblim-cmpi-base provider registration scripts on shared multi-user systems where untrusted users can create symlinks in /tmp or /var/tmp; if manual execution is required, use a private root-owned temporary directory. The proposed code fix replaces predictable temporary filenames with securely generated paths using mktemp (e.g., mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") with umask 077, applied across all affected functions in the registration scripts (Red Hat CVE, Red Hat Bugzilla).

Red Hat classified this vulnerability as Moderate severity, noting that exploitation requires specific conditions including a privileged script execution event and systems without sticky-directory symlink protections. The issue was discovered by Aisle Research in partnership with Red Hat and reported through coordinated disclosure. No significant broader community or media coverage has been identified beyond standard vulnerability database aggregation (Red Hat CVE).