Executive brief
A vulnerability in the haveged entropy daemon, which generates random numbers for Linux systems, allows a local user to gain full administrative (root) control. The software fails to properly block unauthorized users from sending administrative commands to its control socket. An attacker can exploit this to force the daemon into a malicious environment and execute arbitrary code with the highest system privileges.
Technical details
The socket_handler function in src/havegecmd.c performs a credential check using SO_PEERCRED on the abstract UNIX socket (\0/sys/entropy/haveged). While it correctly identifies non-root users (cred.uid != 0) and sends a negative acknowledgement (ASCII_NAK), it fails to return or exit the function. This allows the execution flow to proceed to a switch statement where privileged commands like MAGIC_CHROOT can be processed. An attacker can use MAGIC_CHROOT to force the root-running daemon to chroot into an attacker-controlled directory and execute itself (execv) against malicious libraries, resulting in arbitrary code execution as root. This issue is fixed in version 1.9.21.
Affected products
- jirka-h haveged 1.9.3 to 1.9.20
Timeline
- 2026-05-05: disclosed: Reported to SUSE by Dirk Müller
- 2026-05-19: patched: Fixed in version 1.9.21 and SUSE security updates released
- 2026-05-20: advisory: Public disclosure on oss-security list