canna: unsafe handling of /tmp/.iroha_unix directory

Vulnerability

The canna systemd service on openSUSE Backports SLE-15-SP3 (versions prior to canna-3.7p3-bp153.2.3.1) and SLE-15-SP4 (versions prior to 3.7p3-bp154.3.3.1) uses a publicly accessible directory /tmp/.iroha_unix for a UNIX domain socket, created via systemd-tmpfiles with mode 0755. However, the service unit removes this directory during ExecPre and ExecStopPost, creating a race window where an attacker can pre-create an unsafe directory. The server does not verify directory permissions, leading to improper access control [1].

Exploitation

An attacker with local access can monitor for deletion of /tmp/.iroha_unix using inotify_wait(). Once the directory is removed (e.g., before service start or after stop), the attacker creates a world-writable directory (mode 777) owned by themselves. The cannaserver then creates its socket in this attacker-controlled directory. The attacker can delete the legitimate socket and replace it with a fake one, intercepting client connections [1].

Impact

A successful attacker can intercept traffic between canna clients and the server, reading sensitive input data and returning manipulated responses. This compromises confidentiality and integrity of the interactive session.

Mitigation

Fixed versions are canna-3.7p3-bp153.2.3.1 (SLE-15-SP3) and canna-3.7p3-bp154.3.3.1 (SLE-15-SP4). For openSUSE Factory, the package was deleted instead of being fixed [1]. Users should update to the patched versions; no workaround is available for unpatched installations.