intel-speed-select PidFile Symlink

Vulnerability analysis

The intel-speed-select daemon writes its process ID to a fixed path under /tmp when starting in out-of-band mode. Because the open does not block symbolic links, a local unprivileged user can pre-create a symlink at that path pointing to any file on the system. When the root-run daemon later opens its pidfile, it follows the symlink and writes its process ID into the attacker-chosen target, corrupting that file with root privileges. The fix blocks symbolic links when opening the pidfile and verifies that the opened object is a regular file before proceeding, aborting if a symlink is encountered. Any local unprivileged user can trigger this on a system where the daemon is started in out-of-band mode, and the hardware must support Intel Speed Select Technology.