CVE-2020-10737

What it actually does

The flaw permits a local attacker to create a symbolic link for a new user's home directory pointing to an arbitrary target path, causing the tool to recursively change ownership of that target to the unprivileged user during home directory creation.

Why it matters to the business

Attackers with local access can gain ownership of sensitive system directories, potentially leading to unauthorized access to files, configuration changes, or further privilege escalation on affected systems.

How an attack unfolds

An attacker creates a symlink from the expected home directory path to a target directory they wish to own. When a new user is created and mkhomedir runs, it follows the symlink and changes ownership of the target to the new user, allowing the attacker to access or modify that content.

How to fix it

Update the oddjob package to version 0.34.5 or later. Ensure proper path validation is in place before changing ownership during home directory creation.

How to confirm the fix worked

Verify the installed version of oddjob is at least 0.34.5. Test by attempting to create a user with a symlinked home directory and confirm ownership changes are prevented on target paths.

Typical attack path

1. Create a symlink pointing the prospective home directory to a privileged target path
2. Trigger user creation or home directory initialization for a new account
3. Observe that ownership of the target path has been changed to the unprivileged user
4. Use the newly owned files or directories to escalate privileges or access data

How to detect it

Check system logs for user creation events around the time of suspicious ownership changes on directories. Look for processes invoking mkhomedir with unusual paths. Examine file ownership anomalies on sensitive directories.

• mkhomedir
• /etc/skel
• symlink to /root
• symlink to /etc
• unexpected chown on system directories

What your security team should do

• Upgrade oddjob to a fixed version immediately
• Audit systems for any existing symlink-based ownership changes on sensitive directories
• Monitor for local privilege escalation attempts involving user creation
• Restrict local user creation privileges where possible