Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Link | Tags |
---|---|
https://bugs.gentoo.org/692492 | vendor advisory issue tracking exploit |
http://www.openwall.com/lists/oss-security/2020/01/21/1 | mailing list third party advisory exploit |