CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's power management daemon, which improperly handles pidfile creation by using a fixed path under /tmp, allowing local unprivileged users to create symlinks that redirect the daemon's output to arbitrary files. This can lead to unauthorized file manipulation or data corruption by a local attacker. Organizations running affected Linux distributions should prioritize patching this issue to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing. The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file.