CVE-2026-25704：cosmic-greeter权限提升漏洞

CVE-2026-25704 在 cosmic-greeter 中，Pop!_OS 的一个组件，代表了一个 TOCTOU（时间检查时间使用）竞争条件漏洞。这使得攻击者能够重新获得本来应该被放弃的权限。这个缺陷源于不安全的检查逻辑，它不能保证在条件检查时间和使用时间之间的数据完整性。攻击者可能利用此漏洞执行具有提升权限的代码，从而可能损害系统安全。此漏洞的严重程度取决于 cosmic-greeter 运行的上下文以及攻击者可能获得的权限。应用提供的更新对于减轻此风险至关重要。

Users of Pop!_OS and other Linux distributions that include cosmic-greeter are at risk, particularly those using older, unpatched versions. Systems with custom configurations or modifications to cosmic-greeter may be more vulnerable if the fix was not properly integrated. Shared hosting environments where multiple users share the same system resources are also at increased risk.

• linux / server: Monitor system logs (journalctl) for unusual privilege escalation attempts or errors related to cosmic-greeter. Specifically, look for processes unexpectedly gaining elevated privileges after a user login.

journalctl -u cosmic-greeter -f | grep -i privilege

• linux / server: Use auditd to track file access patterns related to cosmic-greeter and identify any suspicious modifications or access attempts.

auditctl -w /usr/bin/cosmic-greeter -p warx -k cosmic_greeter_audit

• linux / server: Employ tools like lsof or ps to monitor processes running under the cosmic-greeter user and identify any unexpected or unauthorized activity.

ps aux | grep cosmic-greeter
lsof -u cosmic-greeter

1. 2026-03-30Disclosure

   disclosure

1. 已保留2026-02-05
2. 发布日期2026-03-30
3. 修改日期2026-04-16
4. EPSS 更新日期2026-04-06

CVE-2026-25704 的修复方法是将 cosmic-greeter 更新到包含在 https://github.com/pop-os/cosmic-greeter/pull/426 上的修正的版本。此修正通过改进检查逻辑并确保验证和使用之间的数据一致性来解决 TOCTOU 竞争条件。强烈建议 Pop!OS 用户尽快应用此更新，以保护其系统免受潜在攻击。请确保您的系统已更新到最新的系统软件包，以保证应用修正。可以通过标准的 Pop!OS 更新机制执行更新。