Description
Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | kdebase | 4:3.5.9.dfsg.1-6+lenny1 | DSA-2037-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdebase +1 | 6:3.5.4-21.el5_5.1 | RHSA-2010:0348 |
| RHEL 4 | kdebase +1 | 6:3.3.1-13.el4_8.1 | RHSA-2010:0348 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kdebase3 | 4.11.22-6.8 | openSUSE-SU-2024:10023-1 |
Advisories 3
- RHSA-2010:0348 Red Hat Security Advisory: kdebase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2037-1 kdebase - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10023-1 fileshareset-2.0-73.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-2037 vendor-advisory
- kde-kdm-privilege-escalation(57823) vdb-entry
- 39481 third-party-advisory
- RHSA-2010:0348 vendor-advisory
- FEDORA-2010-6605 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=570613
- 39419 third-party-advisory
- SUSE-SR:2010:009 vendor-advisory
- http://www.kde.org/info/security/advisory-20100413-1.txt
- 39506 third-party-advisory
- ADV-2010-0879 vdb-entry
- 39467 vdb-entry
- oval:org.mitre.oval:def:9999 vdb-entry signature