CVE-2019-3461

What it actually does

Race condition during bind mount via rename() allows a local attacker to redirect a file being cleaned by tmpreaper to an arbitrary location on the same filesystem, such as /etc/cron.d/, resulting in arbitrary code execution as root.

Why it matters to the business

Local users on affected Debian systems can obtain full administrative control, enabling data theft, persistence, or disruption of services; the vulnerability affects long-running cleanup utilities and requires urgent patching on any systems still using the vulnerable tmpreaper package.

How an attack unfolds

An attacker with a local account prepares a malicious payload and symlink, then times a rename operation to coincide with tmpreaper's cleanup of a directory on the same filesystem, causing the payload to be placed in a privileged location such as a cron directory for subsequent root execution.

How to fix it

Upgrade tmpreaper to version 1.6.13+nmu1+deb9u1, 1.6.14, or later on all Debian systems; remove or disable the package if temporary-file cleanup is not required.

How to confirm the fix worked

Query the package manager for the installed tmpreaper version and confirm it matches a fixed release; review system cron directories and tmpreaper configuration for unexpected entries.

Typical attack path

1. Gain local unprivileged access on a Debian system running vulnerable tmpreaper
2. Create a directory eligible for cleanup and prepare a malicious file or symlink targeting a privileged path
3. Trigger or wait for tmpreaper execution during its scheduled cleanup
4. Win the rename() race to redirect the file placement into /etc/cron.d/ or equivalent
5. Wait for cron to execute the planted payload as root

How to detect it

Search system and authentication logs for tmpreaper processes executing around the same time as unexpected files appearing in /etc/cron.d/ or other privileged directories; review cron job creation timestamps and any symlinks or renames involving temporary directories.

• /etc/cron.d/
• tmpreaper
• unexpected cron job files with recent timestamps matching tmpreaper execution

What your security team should do

• Immediately upgrade tmpreaper to a fixed version on all Debian hosts
• Inventory systems using tmpreaper and prioritize those with local user accounts
• Monitor package update channels for any additional backports or advisories
• Consider replacing tmpreaper with maintained alternatives such as tmpwatch or systemd-tmpfiles