CVE-2022-3560

What it actually does

The pesign systemd service initialization script applies ACLs to /etc/pki/pesign and /run/pesign without validating whether the target paths are symbolic links, permitting an attacker-controlled link to redirect the operation and grant read access to arbitrary files.

Why it matters to the business

Local users or compromised processes can read sensitive configuration, keys, or other privileged files on affected Linux systems, increasing the risk of credential exposure and further lateral movement inside the environment.

How an attack unfolds

An attacker with local access creates a symbolic link inside the pesign-managed directories that points to a privileged file, then triggers or waits for the service script to run; the script follows the link and sets permissive ACLs, allowing the attacker to read the target file.

How to fix it

Upgrade pesign to a version that validates paths before applying ACLs; until a fix is available, consider disabling the pesign service if not required or restrict membership in the pesign group to only trusted accounts.

How to confirm the fix worked

Inspect the service script for explicit symlink or path validation logic; confirm the service no longer follows attacker-controlled links when setting ACLs; re-test after applying package updates from distribution repositories.

Typical attack path

1. Obtain local user or process access on a system running the pesign service
2. Create a symbolic link inside /etc/pki/pesign or /run/pesign pointing to a desired privileged file
3. Trigger the pesign service unit (or wait for its next execution) so the ACL-setting script processes the link
4. Read the now-accessible target file using the granted ACL

How to detect it

Review system logs for pesign service invocations, unexpected ACL modifications on /etc/pki/pesign or /run/pesign, and creation of symbolic links inside those directories; correlate with user activity that coincides with service restarts.

• symlink creation under /run/pesign
• ACL modification events referencing /etc/pki/pesign
• pesign.service unit activation logs

What your security team should do

• Apply available distribution updates for pesign as soon as they are released
• Audit systems for unnecessary pesign group membership and remove unneeded users
• Monitor package repositories for fixed versions of pesign on Fedora and RHEL