CVE-2021-44512
📋 TL;DR
This vulnerability in tmate-ssh-server allows local attackers to manipulate session files due to insecure directory permissions. Attackers can compromise session integrity or escalate privileges from read-only to read-write sessions. Systems running tmate-ssh-server 2.3.0 with default configurations are affected.
💻 Affected Systems
- tmate-ssh-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation allowing attackers to hijack active sessions, execute arbitrary commands as other users, or compromise the entire tmate service.
Likely Case
Session manipulation allowing attackers to access or modify other users' tmate sessions, potentially leading to unauthorized access to sensitive data or systems.
If Mitigated
Limited impact with proper file permission controls and isolation between user sessions.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is well-documented with proof-of-concept details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 1c020d1f5ca462f5b150b46a027aaa1bbe3c9596
Vendor Advisory: https://github.com/tmate-io/tmate-ssh-server/commit/1c020d1f5ca462f5b150b46a027aaa1bbe3c9596
Restart Required: Yes
Instructions:
1. Update tmate-ssh-server to the latest version. 2. Apply the patch from commit 1c020d1f5ca462f5b150b46a027aaa1bbe3c9596. 3. Restart the tmate-ssh-server service.
🔧 Temporary Workarounds
Secure directory permissions
linuxManually set secure permissions on the /tmp/tmate/sessions directory
chmod 750 /tmp/tmate/sessions
chown root:tmate /tmp/tmate/sessions
Use alternative session directory
linuxConfigure tmate to use a different directory with proper permissions
mkdir -p /var/lib/tmate/sessions
chmod 750 /var/lib/tmate/sessions
chown root:tmate /var/lib/tmate/sessions
Update tmate configuration to use this directory
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the system running tmate-ssh-server
- Monitor the /tmp/tmate/sessions directory for unauthorized file modifications
🔍 How to Verify
Check if Vulnerable:
Check if /tmp/tmate/sessions directory exists and has world-writable permissions: ls -ld /tmp/tmate/sessionsCheck Version:
tmate-ssh-server --version or check package manager for installed versionVerify Fix Applied:
Verify directory permissions are not world-writable: ls -ld /tmp/tmate/sessions should show permissions like drwxr-x---📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /tmp/tmate/sessions directory
- Unexpected file modifications in session directory
Network Indicators:
- Unusual tmate session activity from local users
SIEM Query:
process.name='tmate-ssh-server' AND file.path='/tmp/tmate/sessions/*' AND file.permissions.changed=true