Executive brief
cockpit-files is a file management interface for the Cockpit server administration tool. A local attacker with limited privileges can exploit a timing vulnerability to redirect privileged file operations (like changing ownership or permissions) to unintended files, potentially compromising system integrity and making services unusable. Successful exploitation requires both a privileged Cockpit user and the attacker to win a race condition in a writable directory.
Technical details
A symlink race condition (CWE-363) in cockpit-files during privileged file operations allows a local attacker with low privileges to redirect file ownership and permission changes to arbitrary files. The attack requires user interaction from a privileged Cockpit user performing file operations in a directory writable by the attacker, combined with successful timing manipulation to swap the target with a symlink. The vulnerability affects integrity and availability of system files and services.
Affected products
- Red Hat cockpit-files
Timeline
- 2026-09-18: disclosed