CVE-2024-35235 Cupsd Listen arbitrary chmod 0140777
Attackers can exploit a symlink in the Listen configuration to change file permissions, leading to arbitrary code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35235?
CVE-2024-35235 is a medium-severity vulnerability in Debian Debian Linux, published on 11 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.
Which versions are affected by CVE-2024-35235?
It affects 2 products.
Linux distribution packages (40)
cups AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-client AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-devel AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-filesystem AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-ipptool AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-libs AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups-lpd AlmaLinux:8 | All versions | 1:2.2.6-60.el8_10 |
cups AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-client AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-devel AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-filesystem AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-ipptool AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-libs AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-lpd AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups-printerapp AlmaLinux:9 | All versions | 1:2.3.3op2-27.el9_4 |
cups Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-client Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-client-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-devel Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-filesystem Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-ipptool Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-ipptool-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-lpd Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups-lpd-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-60.el8_10 |
cups Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-client-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-ipptool-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-libs Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups-lpd-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-60.el8_10 |
cups Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-27.el9_4 |
cups-client Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-27.el9_4 |
cups-client-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-27.el9_4 |
cups-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-27.el9_4 |
cups-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-27.el9_4 |
Products include Debian Debian Linux, Openprinting Cups.
How do I fix CVE-2024-35235?
Apply the vendor's patch.
Is CVE-2024-35235 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35235 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2024-35235, ALSA-2024:4265, ALSA-2024:4776, AZL-42579, AZL-42592, BELL-CVE-2024-35235 and 21 more.