The DKMS Makefile used mktemp -u to generate a temporary directory name without atomically creating it, then root-privileged pre-build.sh later created a symlink at that path. A local unprivileged attacker could race to create a malicious symlink at the predicted path between name generation and actual use, redirecting root file writes or rm -rf cleanup to arbitrary paths. This attack recurs on every DKMS rebuild during kernel updates.
Fix by replacing mktemp -ut with mktemp -dt to atomically create the directory with mode 0700. Update pre-build.sh to remove the directory and recreate as symlink. Signed-off-by: Sunday Clement <[email protected]> --- drivers/gpu/drm/amd/dkms/Makefile | 2 +- drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/dkms/Makefile b/drivers/gpu/drm/amd/dkms/Makefile index 8112b9746c8f..02eea52ae0e7 100644 --- a/drivers/gpu/drm/amd/dkms/Makefile +++ b/drivers/gpu/drm/amd/dkms/Makefile @@ -4,7 +4,7 @@ else KERNELVER ?= $(shell uname -r) kernel_build_dir := /lib/modules/$(KERNELVER)/build module_src_dir := $(CURDIR) -module_build_dir := $(shell mktemp -ut amd.XXXXXXXX) +module_build_dir := $(shell mktemp -dt amd.XXXXXXXX) module_build_flags := num_cpu_cores := $(shell which nproc > /dev/null && nproc || echo "1") CC := gcc diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh b/drivers/gpu/drm/amd/dkms/pre-build.sh index 66f7177b6cf9..24f5a13ad854 100755 --- a/drivers/gpu/drm/amd/dkms/pre-build.sh +++ b/drivers/gpu/drm/amd/dkms/pre-build.sh @@ -100,6 +100,10 @@ if version_lt 6.0; then fi export KERNELVER +# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d (mode 0700) +# to eliminate TOCTOU symlink race. We need MODULE_BUILD_DIR to be +# a symlink to DKMS_TREE, so remove the directory and recreate as symlink. +rmdir $MODULE_BUILD_DIR ln -s $DKMS_TREE $MODULE_BUILD_DIR echo "PATH=$PATH" >$MODULE_BUILD_DIR/.env -- 2.43.0
