sblim-cmpi-base EUVD-2026-57827

Exploitation requires: (1) a local unprivileged account on the target system (CVSS PR:L); (2) the sblim-cmpi-base provider registration scripts must execute in a privileged (root) context during the attack window - this is the explicit conditional stated in the description and is not guaranteed on all deployments; (3) the attacker must successfully time symlink placement before the privileged script references the temporary file path (CVSS AC:H - a race condition window). Exploitation is LIMITED by: fs.protected_symlinks=1 (default on RHEL 7+, directly mitigating symlink following in world-writable sticky directories per the description); absence of local interactive user accounts; and environments where the registration scripts do not execute automatically or with elevated privileges. This is not remotely exploitable and is not a default-configuration unauthenticated attack.

The CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately characterizes this as a moderate-to-medium priority. The local attack vector (AV:L) and high complexity (AC:H, reflecting a timing race) significantly constrain real-world exploitability: an attacker must already have an unprivileged local shell on the target and must successfully time the symlink placement within a narrow execution window. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in the CISA KEV catalog - no public exploit code has been identified at time of analysis. The CVSS I:H and A:H components reflect genuine impact if exploitation succeeds (arbitrary root-owned file overwrite, potential service disruption), but these are conditional on the script running in a privileged context, which may not occur on all deployments. This vulnerability is a realistic concern in multi-tenant or shared-access RHEL environments where local unprivileged users exist, but poses minimal risk in single-administrator or container-isolated environments. The description explicitly notes that sticky-directory symlink protections (fs.protected_symlinks=1, default in modern RHEL kernels) may mitigate the attack, further reducing realized risk on patched or hardened systems.

A local unprivileged user identifies that a sblim-cmpi-base provider registration script is scheduled to run as root (e.g., via a package install trigger or cron). Prior to execution, the attacker creates a symlink at the expected temporary file path in a world-writable directory (e.g., /tmp/sblim-tmp-XXXX -> /etc/cron.d/backdoor), then waits for the privileged script to execute and write its output through the symlink to the attacker-controlled target, overwriting a root-owned system file. No public exploit code is known at time of analysis, but the technique is well-understood and any attacker familiar with TOCTOU symlink attacks could attempt it given local access.