attr before version 2

The attr package ships getfattr and setfattr, the userspace CLIs for reading and writing POSIX extended attributes (xattrs). Versions prior to 2.6.0 resolve path components without protecting against an attacker swapping a directory or filename in the path for a symlink between the time the tool validates the path and the time it operates on it — a classic *TOCTOU symlink race* (CWE-59). When a privileged user (commonly root, during backup/restore, package install, or container image build) runs setfattr or getfattr against a path inside an attacker-writable directory (/tmp, /var/tmp, an unprivileged user's $HOME, an extracted tarball), the attacker can redirect the operation to an arbitrary file — leading to xattr disclosure of files outside the intended scope, or *xattr write* (including security.capability, security.selinux, trusted.*) on files the attacker doesn't own.

Vendor HIGH (7.1) is defensible on paper because writing security.capability to an attacker-chosen binary is a clean local privilege-escalation primitive. In reality, the vector is AV:L/PR:L — the attacker must already be a local unprivileged user AND must win a race against a *concurrently running* root invocation of setfattr or getfattr on a path they can influence. That second condition is the kill switch: outside of well-known automation patterns (backup agents that restore xattrs, container build tooling, package post-install scripts), root rarely runs these utilities on attacker-influenced paths. We assess MEDIUM: real, exploitable in specific automation contexts, but not the broad LPE that 7.1 implies for a general fleet.

Why this verdict

• Local-only vector (AV:L) — there is no remote, unauthenticated path. The attacker must already hold a shell on the target, which collapses the addressable population from 'every Linux box' to 'every multi-tenant Linux box.'
• Race-window dependency — exploitation requires a *concurrent* privileged invocation of attr CLIs against an attacker-controlled path. On a typical single-tenant application server with no shell users, this condition simply never materializes.
• Distro defense-in-depth — fs.protected_symlinks=1 (default on Debian, Ubuntu, RHEL, SUSE, Alpine, Arch since ~2015) materially raises the cost of the canonical /tmp symlink swap by blocking cross-UID symlink follows in sticky-bit directories. Not a complete fix (does not cover non-sticky attacker-owned dirs), but real friction.
• Role multiplier — multi-tenant shell hosts / shared CI runners: chain succeeds, blast radius is host-level root → MEDIUM stays MEDIUM, not floored to HIGH because this role is <10% of installed base and the chain remains single-host.
• Role multiplier — backup/restore servers (Bareos, Bacula, Veeam Linux agent, Commvault): chain plausibly succeeds during restore operations that recreate xattrs against staging dirs; blast radius is host-level root on the backup server, which IS a high-value role. However, restores are rare/operator-initiated, and the attacker needs prior local foothold on the backup server itself. Floor stays at MEDIUM; closely monitor.

Why not higher?

Not HIGH because no remote vector exists, the chain requires the attacker to already be local-authenticated, AND a second prerequisite (concurrent root attr invocation on attacker-influenced path) gates exploitation. On the majority of single-tenant servers, this second prerequisite never occurs. HIGH would be appropriate if the bug were in the kernel xattr layer (universal) or if attr CLIs were routinely invoked by root on /tmp-class paths by default — neither is true.

Why not lower?

Not LOW because the primitive — arbitrary security.capability write — is a clean local privilege escalation when the race lands. On multi-tenant hosts (university, hosting, shared CI, jumpboxes), this is genuinely exploitable and the chain ends in root. The bug also lives in a near-universally installed package, so fleet-wide patching is non-trivial. LOW would understate the LPE potential on the slice of fleet where it matters.

1. Verify fs.protected_symlinks=1 and fs.protected_hardlinks=1 are set fleet-wide — These sysctls have been default-on in mainstream distros since 2015 but configuration drift happens. Enforce via Ansible/Puppet/SCM. This blocks the canonical /tmp symlink-swap variant. Deploy within the noisgate mitigation SLA — no mitigation SLA for MEDIUM, but this is a 10-minute hygiene fix you should do this week regardless.
2. Inventory and audit root-run invocations of setfattr/getfattr — Grep cron jobs, systemd units, ansible playbooks, container build pipelines, and backup tooling for setfattr, getfattr, tar --xattrs, rsync -X, cp --preserve=xattr. Anywhere root operates on an attacker-influenceable path is a hot spot. Refactor to operate inside private staging directories (mktemp -d with 0700) or behind openat2(RESOLVE_BENEATH) wrappers.
3. Enable IMA/EVM appraisal on hardened tiers — If you run a Linux integrity baseline (IMA-appraise with EVM-protected xattrs), unauthorized security.capability writes are rejected at the kernel layer. Already deployed? Confirm enforcement is enforce, not log. Realistic for hardened/regulated tiers; impractical for the full fleet inside a 30-day window.
4. Restrict shell access on application servers — Most enterprise Linux servers should not have interactive non-admin users. Audit /etc/passwd for /bin/bash-shelled UIDs without business justification and convert to /sbin/nologin. Removes the attacker's foothold prerequisite entirely.
5. Patch to attr 2.6.0 (or distro backport) when available — Track your distro's attr package security advisory. Roll through standard package management — attr is leaf-installed, no service restart required. Within the noisgate remediation SLA of 365 days for MEDIUM; do it during normal monthly patch cycles, no emergency change needed.

Run on the target Linux host as any user (no privileges required for the version check). Example: ./check-cve-2026-54371.sh. Reports VULNERABLE if installed attr is older than 2.6.0, PATCHED if 2.6.0 or newer, UNKNOWN if getfattr is not present or version parsing fails.

#!/usr/bin/env bash
# check-cve-2026-54371.sh
# Detects vulnerable attr package (< 2.6.0) for CVE-2026-54371.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -u

FIXED_MAJOR=2
FIXED_MINOR=6
FIXED_PATCH=0

if ! command -v getfattr >/dev/null 2>&1; then
    echo "UNKNOWN: getfattr not installed on this host"
    exit 2
fi

# getfattr --version output: 'getfattr 2.5.1'
RAW="$(getfattr --version 2>/dev/null | head -1 | awk '{print $NF}')"
if [[ -z "$RAW" ]]; then
    echo "UNKNOWN: could not parse getfattr --version"
    exit 2
fi

IFS='.' read -r MAJ MIN PAT <<< "$RAW"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

# Numeric comparison
if (( MAJ > FIXED_MAJOR )) || \
   { (( MAJ == FIXED_MAJOR )) && (( MIN > FIXED_MINOR )); } || \
   { (( MAJ == FIXED_MAJOR )) && (( MIN == FIXED_MINOR )) && (( PAT >= FIXED_PATCH )); }; then
    echo "PATCHED: attr $RAW (>= 2.6.0)"
    exit 0
fi

# Distro backport check — RHEL/Debian may ship 2.5.x with patch applied
DISTRO_PKG=""
if command -v rpm >/dev/null 2>&1; then
    DISTRO_PKG="$(rpm -q attr 2>/dev/null)"
elif command -v dpkg-query >/dev/null 2>&1; then
    DISTRO_PKG="$(dpkg-query -W -f='${Package} ${Version}\n' attr 2>/dev/null)"
fi

echo "VULNERABLE: attr $RAW (< 2.6.0)"
[[ -n "$DISTRO_PKG" ]] && echo "  Distro package: $DISTRO_PKG (check vendor advisory for backport status)"
echo "  Verify sysctl: $(sysctl -n fs.protected_symlinks 2>/dev/null || echo 'unset') (want: 1)"
exit 1

Sources

1. Savannah attr project
2. getfattr(1) man page
3. setfattr(1) man page
4. CWE-59: Improper Link Resolution Before File Access ('Link Following')
5. Linux kernel fs.protected_symlinks documentation
6. openat2() RESOLVE_BENEATH (Linux 5.6+)
7. Linux file capabilities (capabilities(7))
8. CISA KEV catalog