GHSA-gj33-wxpv-6fgg on Cyberus Linux 26.05

Aliases: GHSA-gj33-wxpv-6fgg

Packages: cups

Status: Plausible

Advisory Information

ZDI-CAN-33033: OpenPrinting CUPS Scheduler Configuration Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

-- CVSS -----------------------------------------

7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

-- ABSTRACT -------------------------------------

Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: OpenPrinting - CUPS

-- VULNERABILITY DETAILS ------------------------ * Version Tested: 82fa7655d992632f49497d5cd445dcc724bd883e * Platform Tested:ubuntu 26.04

Analysis
At the vulnerable commits, `cupsdCheckPermissions()` performs `lstat()` and
records whether the path is a symlink. If it initially observes a directory,
it later applies `chown()` and `chmod()` to the original pathname without
pinning or revalidating the inode. An `lp` process can replace
`CacheDir/rss` inside its group-writable parent between those operations.

The trigger of the cupsdCheckPermissions() requires CUPS admin.
So, this requires lp user + CUPS admin to escalate as root locally, see CVE-2026-55480.
// scheduler/conf.c - cupsdCheckPermissions(), which is called as cupsdCheckPermissions("/var/cache/cups/rss", NULL, 0775, RunUser=0(root), Group=7(lp), is_dir=1, create_dir=1)
...
    if (lstat(filename, &fileinfo))                       // (1) time of check
...
    if ((is_symlink = S_ISLNK(fileinfo.st_mode)) != 0)
...
    if (!dir_created && is_dir && !S_ISDIR(fileinfo.st_mode))
..
  if (!dir_created && !is_dir && !S_ISREG(fileinfo.st_mode))
...
    if (is_symlink)
...

    if (dir_created || fileinfo.st_uid != user || fileinfo.st_gid != group)
    {
      if (chown(filename, user, group) && !getuid())      // (2) time of use, chown() FOLLOWS the swapped symlink -> chowns /etc to root:lp.
...

    if (dir_created || (fileinfo.st_mode & 07777) != mode)
    {
      if (chmod(filename, mode))                          // (3) time of use, chmod(0775) -> also follows the symlink.
...
Exploit output
PoC: /root/permission_race_poc.py
Target: /etc  |  Mode: --root-proof (plants ld.so.preload, uses fixed root cups-deviced helper)

PASS: standalone CUPS permission-repair TOCTOU reproduced
Run: 8108df7501c6
Admin-triggered reloads: 36
result=permission-repair-race-won
worker_uid=7 worker_gid=7
active_original_dev=90 ino=1179830 mode=0775 uid=0 gid=7
checked_directory_candidate_dev=90 ino=1179837 mode=0700 uid=7 gid=7
target_before_dev=90 ino=1179774 mode=0755 uid=0 gid=0
target_after_dev=90 ino=1179774 mode=0775 uid=0 gid=7
candidate_target_same_inode=no
target_inode_watch=active attrib_events=1
rename_exchange_calls=1008346
preload_planted=yes
owner=root:root mode=644
uid=0(root) euid=0(root) via fixed CUPS root helper
PASS: exact-state cleanup=true
-- CREDIT --------------------------------------- This vulnerability was discovered by: Rocco Calvi (@TecR0c) and Edward Morris (edwardgmorris.com) with TecSecurity working with TrendAI Zero Day Initiative

-- FURTHER DETAILS ------------------------------

Supporting files: ZDI-CAN-33033.zip

If supporting files were contained with this report they are provided within a password protected ZIP file. The password is the ZDI candidate number in the form: ZDI-CAN-XXXX where XXXX is the ID number.

Please confirm receipt of this report. We expect all vendors to remediate ZDI vulnerabilities within 120 days of the reported date. If you are ready to release a patch at any point leading up to the deadline, please coordinate with us so that we may release our advisory detailing the issue. If the 120-day deadline is reached and no patch has been made available we will release a limited public advisory with our own mitigations, so that the public can protect themselves in the absence of a patch. Please keep us updated regarding the status of this issue and feel free to contact us at any time:

Zero Day Initiative zdi-disclosures@trendmicro.com

The PGP key used for all ZDI vendor communications is available from:

http://www.zerodayinitiative.com/documents/disclosures-pgp-key.asc

-- INFORMATION ABOUT THE ZDI -------------------- Established by TippingPoint and acquired by Trend Micro, the Zero Day Initiative (ZDI) neither re-sells vulnerability details nor exploit code. Instead, upon notifying the affected product vendor, the ZDI provides its Trend Micro TippingPoint customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available.

Please contact us for further details or refer to:

http://www.zerodayinitiative.com

-- DISCLOSURE POLICY ----------------------------

Our vulnerability disclosure policy is available online at:

http://www.zerodayinitiative.com/advisories/disclosure_policy/

Fix

[master bdba79680138fa0702236afd55e9c49426b4f01d] Refactor cupsdCheckPermissions to use fd-based calls (GHSA-gj33-wxpv-6fgg)

[2.4.x a7bd8ba80c2abb1d15dffc6c5ad7aece0c7b9db9] Refactor cupsdCheckPermissions to use fd-based calls (GHSA-gj33-wxpv-6fgg)

Updates

2026-10-02 23:49 CEST

Metadata changes:

Status for package cups: “Plausible”

2026-10-02 23:44 CEST

Metadata changes:

Status for package cups: “New”