Tried, Tested and Proven

Vulnerability title: Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-driver

CVE: CVE-2015-7724
Vendor: AMD
Product: fglrx-driver
Affected version: 15.7
Fixed version: 15.9
Reported by: Tim Brown


In the process of validating the fix for CVE-2015-7723, it has been identified that the userland portion of the fglrx-driver utilised by Xorg still allows privilege escalation via symlink attacks on POSIX shared memory with insecure permissions.

As with the original vulnerability, with a Linux kernel where fs.protected_symlinks is not set to 1, or where this feature is not available, the following code (present in shared libraries distributed as part of fglrx-driver) calls shm_open() with insecure flags specified which allows the Linux kernel to follow an existent symlink under /dev/shm:

mov $0x1b6,%edx ; $edx (mode) = 0666
mov $0x42,%esi ; $esi (oflag) = O_CREAT | O_RDWR - missing O_EXCL
mov %r13,%rdi
callq 208b68 <shm_open@plt>

The same call to shm_open() requests that the permissions of newly created file are 0666 and as a result, an arbitrary file, owned by root, with permissions of 0666 can be created anywhere on the filesystem.

Furthermore, the code then proceeds to force the permissions on the resultant file to 0666 using fchmod(). This can be useful if the symlink target already exists:

mov $0x1b6,%esi ; $esi (mode) = 0666
mov %eax,%edi
callq 209058 <fchmod@plt>


An attacker could create security sensitive files (such as libraries or configuration files), which when processed by a privileged program will lead to privilege escalation in instances where the program runs with privileges that the attacker does not have. For example, if the program is SetUID root, by creating a malicious library within a trusted location, an attacker would obtain root privileges upon exploiting this vulnerability.


The proof of concept exploit is available.


The vendor has released a patch.

Vendor status:

07/10/2015 Cloned from CVE-2015-7723
07/10/2015 MITRE assigned CVE-2015-7724
19/10/2015 Published

Copyright © Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.


The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.