CVE-2024-33904 (published 2024-04-29T06:15Z)

In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbitrary assembly code by writing to a predictable temporary file.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/hyprwm/Hyprland
commit_details: repo_url: https://github.com/hyprwm/Hyprland
author: Vaxry
author_date: 2024-04-28 18:28:19+01:00
msg: hooksystem: use a random 700 directory for assembler
repository: repo_url: https://github.com/hyprwm/Hyprland
repo_name: hyprwm/Hyprland
description: Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks.
repo_language: C++
owner: hyprwm
file_changes: filename: HookSystem.cpp
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 #include "HookSystem.hpp"
 #include "../debug/Log.hpp"
 #include "../helpers/VarList.hpp"
+#include "../managers/TokenManager.hpp"
 
 #define register
 #include <udis86.h>
@@ -135,24 +136,30 @@ CFunctionHook::SAssembly CFunctionHook::fixInstructionProbeRIPCalls(const SInstr
         currentAddress += len;
     }
 
-    std::ofstream ofs("/tmp/hypr/.hookcode.asm", std::ios::trunc);
+    const auto RANDOMDIR = "/tmp/hypr/" + g_pTokenManager->getRandomUUID();
+
+    if (!std::filesystem::create_directory(RANDOMDIR))
+        return {};
+
+    std::filesystem::permissions(RANDOMDIR, std::filesystem::perms::owner_all, std::filesystem::perm_options::replace);
+
+    std::ofstream ofs(RANDOMDIR + "/.hookcode.asm", std::ios::trunc);
     ofs << assemblyBuilder;
     ofs.close();
-    std::string ret = execAndGet(
-        "cc -x assembler -c /tmp/hypr/.hookcode.asm -o /tmp/hypr/.hookbinary.o 2>&1 && objcopy -O binary -j .text /tmp/hypr/.hookbinary.o /tmp/hypr/.hookbinary2.o 2>&1");
+    std::string ret = execAndGet(std::string{"cc -x assembler -c " + RANDOMDIR + "/.hookcode.asm -o " + RANDOMDIR + "/.hookbinary.o 2>&1 && objcopy -O binary -j .text " +
+                                             RANDOMDIR + "/.hookbinary.o " + RANDOMDIR + "/.hookbinary2.o 2>&1"}
+                                     .c_str());
     Debug::log(LOG, "[functionhook] assembler returned:\n{}", ret);
-    if (!std::filesystem::exists("/tmp/hypr/.hookbinary2.o")) {
-        std::filesystem::remove("/tmp/hypr/.hookcode.asm");
-        std::filesystem::remove("/tmp/hypr/.hookbinary.asm");
+    if (!std::filesystem::exists(RANDOMDIR + "/.hookbinary2.o")) {
+        std::filesystem::remove(RANDOMDIR + "/.hookcode.asm");
+        std::filesystem::remove(RANDOMDIR + "/.hookbinary.asm");
         return {};
     }
 
-    std::ifstream ifs("/tmp/hypr/.hookbinary2.o", std::ios::binary);
+    std::ifstream ifs(RANDOMDIR + "/.hookbinary2.o", std::ios::binary);
     returns = {std::vector<char>(std::istreambuf_iterator<char>(ifs), {})};
     ifs.close();
-    std::filesystem::remove("/tmp/hypr/.hookcode.asm");
-    std::filesystem::remove("/tmp/hypr/.hookbinary.o");
-    std::filesystem::remove("/tmp/hypr/.hookbinary2.o");
+    std::filesystem::remove_all(RANDOMDIR);
 
     return returns;
 }

programming_language: C++