Description
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | oddjob | before 0.34.5, before 0.34.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | oddjob | 0.34.6-1 | — |
| Debian 13 | oddjob | 0.34.6-1 | — |
| Debian 12 | oddjob | 0.34.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | oddjob | 0.34.4-1ubuntu0.1~esm1 | USN-5169-1 |
| Ubuntu Pro 18.04 LTS | oddjob | 0.34.3-4ubuntu0.1~esm1 | USN-5169-1 |
| Ubuntu Pro 16.04 LTS | oddjob | 0.34.3-2ubuntu0.1~esm1 | USN-5169-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | oddjob +1 | 0.34.5-3.el8 | RHSA-2020:4687 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | oddjob | 0.34.5-1.9 | openSUSE-SU-2024:11109-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | oddjob +1 | 0.34.5-3.el8 | ELSA-2020-4687 |
Advisories 5
- USN-5169-1 oddjob vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- RHSA-2020:4687 Red Hat Security Advisory: oddjob security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2024:11109-1 oddjob-0.34.5-1.9 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2022-0193 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
- ELSA-2020-4687 Moderate: oddjob security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020