CVE-2024-33904 – This CVE describes a race condition vulnerabili... (How to Fix)

📋 TL;DR

This CVE describes a race condition vulnerability in Hyprland's HookSystem.cpp that allows local attackers to execute arbitrary assembly code by writing to a predictable temporary file. The vulnerability affects Hyprland versions through 0.39.1 before commit 28c8561. Local users on affected systems can potentially escalate privileges or execute malicious code.

💻 Affected Systems

Products:

Hyprland

Versions: All versions through 0.39.1 (before commit 28c85619243e6320e75d7abcfe8244fa99d054dd)

Operating Systems: Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Hyprland installed and running. Requires local user access to exploit.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, complete system compromise, installation of persistent backdoors or malware

🟠

Likely Case

Local user privilege escalation, unauthorized code execution within user context

🟢

If Mitigated

Limited impact due to proper file permissions, SELinux/AppArmor restrictions, or non-local attack vectors

🌐 Internet-Facing: LOW - Requires local access to the system

🏢 Internal Only: MEDIUM - Local users can exploit, but requires specific conditions and user interaction

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and race condition timing. The vulnerability is in the temporary file handling logic.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in commit 28c85619243e6320e75d7abcfe8244fa99d054dd and later versions

Vendor Advisory: https://github.com/hyprwm/Hyprland/commit/28c85619243e6320e75d7abcfe8244fa99d054dd

Restart Required: Yes

Instructions:

1. Update Hyprland to version after commit 28c8561
2. Rebuild from source if using source installation
3. Restart Hyprland compositor
4. Verify the fix by checking the commit hash includes 28c8561

🔧 Temporary Workarounds

Restrict temporary file permissions

linux

Set strict permissions on temporary directories to prevent unauthorized writes

chmod 1777 /tmp
chmod 700 ~/.cache/hyprland

Disable vulnerable hook functionality

linux

Temporarily disable hook system if not required

Comment out or remove hook-related configurations in hyprland.conf

🧯 If You Can't Patch

Implement strict file permission controls on temporary directories
Use SELinux or AppArmor to restrict Hyprland's file access capabilities

🔍 How to Verify

Check if Vulnerable:

Check Hyprland version: hyprctl version | grep 'tag:'

Check Version:

hyprctl version

Verify Fix Applied:

Verify commit includes 28c8561: git log --oneline | grep 28c8561

📡 Detection & Monitoring

Log Indicators:

Unusual file creation in /tmp or cache directories by Hyprland process
Suspicious process execution from temporary files

Network Indicators:

None - local exploitation only

SIEM Query:

process.name="hyprland" AND file.path="/tmp/*" AND file.action="create"

📊 Metadata

CVE ID: CVE-2024-33904

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-362

Published: April 29, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-33904, you might also want to check these: