Executive brief
SWUpdate, a software update agent for embedded Linux systems, is vulnerable to a flaw that allows a local user to gain full administrative (root) control. By exploiting a timing issue during the update process, an attacker can swap legitimate update files with malicious ones before they are executed. This could lead to the installation of unauthorized software or a complete takeover of the affected device.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in SWUpdate's handling of temporary directories during the update extraction process. SWUpdate extracts signed CPIO archives to a temporary directory (typically /tmp) and performs integrity checks on individual files. Because /tmp often has the sticky bit set, a local unprivileged attacker can pre-create a 'scripts' directory or manipulate the file structure between the time SWUpdate verifies the signature/integrity and the time it executes the contained scripts. This allows the attacker to bypass signature verification and execute arbitrary code with root privileges. The vulnerability is addressed in version 2026.05 by ensuring proper directory validation and cleanup.
Affected products
- sbabic SWUpdate before 2026.05
Timeline
- 2026-06-03: advisory: NVD publication date
- 2026-05-29: patched: Fix committed to repository