nvidia-cg-toolkit-installer in nvidia-cg-toolkit 2.0.0015 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvidia-cg-toolkit-manifest temporary file.
{
"binaries": [
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcg"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcggl"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-dev"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-toolkit"
}
]
}{
"binaries": [
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcg"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcggl"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-dev"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-toolkit"
}
]
}{
"binaries": [
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcg"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "libcggl"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-dev"
},
{
"binary_version": "3.1.0013-5build1",
"binary_name": "nvidia-cg-toolkit"
}
]
}