CVE-2024-33904

Published: Apr 29, 2024Modified: Jun 17, 2026Deferred

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbitrary assembly code by writing to a predictable temporary file.

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (6)

https://github.com/hyprwm/Hyprland/commit/28c85619243e6320e75d7abcfe8244fa99d054dd

Source: cve@mitre.org

https://github.com/hyprwm/Hyprland/issues/5787

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2024/04/28/3

Source: cve@mitre.org

https://github.com/hyprwm/Hyprland/commit/28c85619243e6320e75d7abcfe8244fa99d054dd

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/hyprwm/Hyprland/issues/5787

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.openwall.com/lists/oss-security/2024/04/28/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.