CVE-2024-34490

What it actually does

The vulnerability stems from Maxima's plotting facilities (including plot2d) using predictable filenames under /tmp without secure creation primitives, enabling a local attacker to pre-populate those paths and thereby control file contents read or written during plotting operations.

Why it matters to the business

Organizations relying on Maxima for data visualization face risk of manipulated or corrupted plot outputs that could undermine analysis integrity; impact is limited to local high-privileged attackers and remains low-probability given stable low EPSS and absence from KEV.

How an attack unfolds

A local attacker anticipates the deterministic temporary file names generated by Maxima's plotting code, creates files with matching names in /tmp ahead of time, and waits for a user or process to invoke a plotting command such as plot2d; the application then operates on the attacker-controlled files instead of safely generated ones.

How to fix it

Upgrade Maxima to the version containing commit 51704c or later that replaces predictable /tmp names with secure temporary file APIs; restrict plotting to trusted contexts and consider running Maxima inside a sandbox that limits /tmp access until patched.

How to confirm the fix worked

Confirm the installed Maxima version incorporates commit 51704c; inspect plotting source for use of mktemp or equivalent secure functions instead of hardcoded or predictable /tmp paths; test by attempting to pre-create the former predictable names and verifying they are no longer used.

Typical attack path

1. Gain local access with sufficient privileges to write to /tmp
2. Observe or deduce the predictable temporary filenames used by Maxima plotting routines
3. Pre-create files with identical names containing attacker-chosen content
4. Trigger plotting functionality (e.g., plot2d) from a Maxima session
5. Observe or leverage the resulting controlled plot output or side effects

How to detect it

Review /tmp directory listings and process logs around Maxima execution times for files whose names match historical predictable patterns used by the plotting modules; correlate with user activity that invokes plot2d or similar commands.

What your security team should do

• Prioritize upgrade to the fixed Maxima release containing commit 51704c
• Apply filesystem monitoring on /tmp for unexpected file creation by non-root users during plotting windows
• Limit use of Maxima plotting to dedicated, low-privilege analysis accounts where feasible