Description
OpenFabrics ibutils 1.5.7 allows local users to overwrite arbitrary files via a symlink attack on (1) ibdiagnet.db, (2) ibdiagnet.fdbs, (3) ibdiagnet_ibis.log, (4) ibdiagnet.log, (5) ibdiagnet.lst, (6) ibdiagnet.mcfdbs, (7) ibdiagnet.pkey, (8) ibdiagnet.psl, (9) ibdiagnet.slvl, or (10) ibdiagnet.sm in /tmp/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ibutils | 1.5.7-2 | — |
| Debian 13 | ibutils | 1.5.7-2 | — |
| Debian 12 | ibutils | 1.5.7-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ibutils | No fix yet | — |
| Ubuntu 26.04 LTS | ibutils | No fix yet | — |
| Ubuntu 25.10 | ibutils | No fix yet | — |
| Ubuntu 24.04 LTS | ibutils | No fix yet | — |
| Ubuntu 22.04 LTS | ibutils | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ibutils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ibutils +2 | 1.5.7-8.el6 | RHSA-2013:1661 |
| RHEL 6 | infinipath-psm +1 | 3.0.1-115.1015_open.2.el6 | RHSA-2013:1661 |
| RHEL 6 | libibverbs +3 | 1.1.7-1.el6 | RHSA-2013:1661 |
| RHEL 6 | libmlx4 +1 | 1.0.5-4.el6.1 | RHSA-2013:1661 |
| RHEL 6 | librdmacm +3 | 1.0.17-1.el6 | RHSA-2013:1661 |
| RHEL 6 | mpitests +5 | 3.2-9.el6 | RHSA-2013:1661 |
| RHEL 6 | mstflint | 3.0-0.6.g6961daa.1.el6 | RHSA-2013:1661 |
| RHEL 6 | openmpi +1 | 1.5.4-2.el6 | RHSA-2013:1661 |
| RHEL 6 | perftest | 2.0-2.el6 | RHSA-2013:1661 |
| RHEL 6 | qperf | 0.4.9-1.el6 | RHSA-2013:1661 |
| RHEL 6 | rdma | 3.10-3.el6 | RHSA-2013:1661 |
Advisories 1
- RHSA-2013:1661 Red Hat Security Advisory: RDMA stack security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 20130306 OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability mailing-list
- 58335 vdb-entry
- [oss-secuirty] 20130325 Re: CVE request: ibutils improper use of files in /tmp mailing-list
- [oss-secuirty] 20130326 Re: CVE request: ibutils improper use of files in /tmp mailing-list
- RHSA-2013:1661 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- https://bugzilla.redhat.com/show_bug.cgi?id=927430
- [oss-security] 20130319 Fwd: CVE requests mailing-list
- [oss-secuirty] 20130326 Re: CVE request: ibutils improper use of files in /tmp mailing-list