CVE-2026-16791

Executive Summary

CVE-2026-16791 is a predictable temporary file symlink vulnerability (CWE-377) affecting the Linux version of Lenovo XClarity Essentials OneCLI versions 5.5.0 and below. A local low-privileged attacker can leverage this flaw to overwrite or truncate arbitrary files on the system when OneCLI is executed with elevated privileges (e.g., via sudo). The vulnerability carries a CVSS score of 3.9 (Low severity), with a low EPSS probability of exploitation (0.00088). While no public exploit code exists, the attack primitive is well-understood within the symlink race condition class, and a vendor patch is claimed but not yet independently confirmed.

Technical Analysis

The vulnerability resides in the temporary file creation routines of Lenovo XClarity Essentials OneCLI when running on Linux platforms. OneCLI is a systems-management utility used to configure, inventory, and update Lenovo servers and chassis. During normal operation, particularly during firmware update or BIOS configuration tasks, OneCLI creates temporary files in world-writable directories (historically /tmp, /var/tmp, or similar) to stage data.

The flaw is classified under CWE-377 (Insecure Temporary File), which describes the creation of temporary files in a directory with insecure permissions or using predictable naming schemes. In this case, OneCLI fails to use safe temp-file creation functions (e.g., mkstemp(), O_CREAT | O_EXCL with random names). Instead, it constructs temp file paths using predictable patterns based on process ID, timestamps, or a fixed filename template.

Attack Mechanism:

1. File name prediction: An attacker on the same host can monitor OneCLI processes (via ps, inotify on /tmp, or scanning for newly created files) to deduce the naming pattern of the temporary files OneCLI creates.

2. Symlink pre-creation: Prior to OneCLI executing, the attacker places a symbolic link at the predicted temp file path, pointing to an arbitrary target file on the system (e.g., /etc/passwd, /etc/crontab, a configuration file, or a file owned by root).

3. Privileged write/truncate: When OneCLI is executed with elevated privileges (via sudo or a setuid context) and attempts to open the temp file for writing, the kernel follows the symlink and opens the target file with OneCLI's elevated privileges. OneCLI then writes program-generated data into that file, either truncating the original contents or overwriting them with structured data.

4. No race condition needed: Because the symlink is placed before OneCLI runs (pre-race), this is often easier to exploit than a classic TOCTOU race window. The attacker must only predict the path ahead of time.

Attack Surface:

• Local multi-user Linux environments where OneCLI is used for server management tasks.
• Environments where administrative workflows trigger OneCLI with elevated privileges (e.g., backup scripts, cron jobs, IT-admin operations).
• The attack requires local access (AV:L), low privilege to create symlinks (PR:L), and user interaction (UI:R) — the victim (admin) must execute OneCLI while the attacker's symlink is in place.

Exploitation Scenarios

Scenario: Privilege Escalation via Cron Overwrite

1. Reconnaissance / Target Identification:

   • The attacker gains a low-privileged foothold on the Linux server (e.g., a compromised web application account or a legitimate unprivileged user).
   • Attacker inspects running processes (e.g., ps aux | grep -i onecli), watches /tmp with inotify, or reviews scripts in /usr/local/bin or /etc/cron.d to understand when OneCLI is scheduled to run.
   • Attacker identifies a predictable temp file pattern. For example, OneCLI creates /tmp/onecli_<PID>.tmp or /tmp/OneCLI_update_data.

2. Weaponization / Trigger Setup:

   • Attacker pre-places symlinks for multiple predicted paths, e.g.:

     ln -s /etc/crontab /tmp/onecli_9999.tmp
     ln -s /etc/crontab /tmp/onecli_10000.tmp
     ln -s /etc/crontab /tmp/onecli_10001.tmp
     

   • Each symlink points to a privileged target file the attacker wants to corrupt.

3. Execution:

   • The attacker waits for an administrator (or a scheduled automation) to run OneCLI with elevated privileges — e.g., sudo onecli config --bios ....
   • OneCLI creates its temp file, following the attacker's symlink. The program opens /etc/crontab with root privileges and writes its generated data (a mix of JSON, binary firmware payloads, or log strings) into the file — truncating the original cron entries.

4. Post-Exploitation Impact:

   • The root crontab is corrupted. If the admin restores it with a default config, the attacker may race again with a modified payload. Alternatively, the attacker targets /root/.ssh/authorized_keys — OneCLI overwrites it with binary garbage, breaking SSH access (DoS).
   • In a more controlled scenario, the attacker targets /etc/ld.so.preload or a setuid binary — corrupting it with OneCLI data may cause unexpected behavior, a crash, or (if data is somewhat controlled) a partial overwrite enabling local privilege escalation.

Scenario: Availability Impact on Configuration Files

1. Attacker pre-creates a symlink at the predicted path pointing to /etc/passwd.
2. Admin runs OneCLI to update firmware. OneCLI truncates /etc/passwd and writes temporary data into it — all users are locked out of the system (total DoS).
3. Recovery requires booting into single-user mode, making the attack highly disruptive in a datacenter context.

Impact Assessment

CVSS Analysis (3.9 Low):

• Attack Vector (AV:L): Requires local access; not remotely exploitable.
• Attack Complexity (AC:L): No special conditions beyond file-permission enforcement being standard.
• Privileges Required (PR:L): Any unprivileged account capable of creating symlinks in /tmp.
• User Interaction (UI:R): An admin must invoke OneCLI with elevated privileges.
• Confidentiality Impact (C:N): The attacker does not read data; they overwrite it.
• Integrity Impact (I:L): Arbitrary file truncation/overwrite with program-controlled data.
• Availability Impact (A:L): System instability or DoS from corrupted system files.

Business Impact:

• Critical infrastructure risk: Lenovo XClarity is used in enterprise datacenters and HPC clusters. A local attacker with this primitive can corrupt firmware-flashing utilities, causing servers to fail provisioning.
• Multi-tenant environments: In shared Linux hosts (hpc clusters, multi-tenant lab environments), a low-privileged user can damage another tenant's files or the host OS.
• Recovery costs: Corrupted system files (/etc/passwd, /etc/shadow, /root/.ssh/authorized_keys) may require manual intervention, boot recovery processes, and significant IT staff time.

Blast Radius:

• Limited to the local host where OneCLI runs.
• The data written is program-generated (not attacker-controlled), limiting the attacker to truncation/DoS or opportunistic corruption rather than precise file injection.
• Symlink attacks can target any file on the filesystem readable/writable by the OneCLI process's effective UID (typically root).

Detection Guidance

Sigma Rule

title: Suspicious Symlink Creation Targeting Lenovo OneCLI Temp Files
id: 3f8b4c6e-9d10-4a2b-b5c6-esymp1inkcve
status: experimental
description: Detects creation of symlinks in /tmp that match Lenovo OneCLI predictable temp file patterns, potentially indicating CVE-2026-16791 exploitation.
references:
    - https://support.lenovo.com/us/en/solutions/ht116433
tags:
    - attack.impact
    - attack.defense_evasion
    - cve.2026.16791
logsource:
    category: process_creation
    product: linux
detection:
    selection_symlink:
        Image|endswith: '/ln'
        CommandLine|contains|all:
            - '-s'
            - '/tmp/'
        CommandLine|contains:
            - 'onecli'
            - 'OneCLI'
            - 'xclarity'
            - 'xcl'
    selection_target:
        CommandLine|contains:
            - '/etc/passwd'
            - '/etc/crontab'
            - '/etc/shadow'
            - '/root/.ssh'
            - '/etc/ld.so.preload'
    condition: selection_symlink and selection_target
    falsepositives:
        - Legitimate administrative scripts creating convenience symlinks
level: high

YARA Rule

rule Detect_Lenovo_OneCLI_Symlink_Exploit_Assets
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects files/scripts referencing CVE-2026-16791 predictable temp file exploitation or known OneCLI temp file path patterns"
        date = "2026-01-01"
        reference = "https://support.lenovo.com/us/en/solutions/ht116433"
        score = 60

    strings:
        $s1 = "/tmp/onecli_" ascii nocase
        $s2 = "OneCLI" ascii nocase
        $s3 = "mkstemp" ascii nocase
        $s4 = "O_CREAT" ascii nocase
        $s5 = "symlink" ascii nocase
        $s6 = "ln -s" ascii nocase
        $t1 = "/etc/passwd" ascii
        $t2 = "/etc/crontab" ascii
        $t3 = "/etc/shadow" ascii
        $t4 = "/root/.ssh/authorized_keys" ascii

    condition:
        (uint16(0) == 0x2321 and #s1 > 0 and #s3 > 0) or
        (any of ($s*) and any of ($t*))
}

Suricata IDS Rule

# Suricata rule for CVE-2026-16791 - Local attack; logging file modifications.
# This rule focuses on detecting shell commands that create symlinks targeting sensitive files with OneCLI context.
alert shell any any -> any any (msg:"CVE-2026-16791 - Suspicious symlink creation targeting /tmp OneCLI paths"; content:"ln -s"; content:"/tmp/"; content:"onecli"; sid:2026016791; rev:1;)

Elastic Detection

// Elastic EQL: Detect symlink creation matching OneCLI temp patterns
process where event.type == "start" and process.name == "ln" and
process.args like "* -s /*" and
process.args like "/tmp/*onecli*" and
process.args in (
  "/etc/passwd", "/etc/crontab", "/etc/shadow",
  "/root/.ssh/authorized_keys", "/etc/ld.so.preload"
)

Splunk SPL Query

index=linux_audit OR index=process_creation
| where match(process, "(?i)ln") 
| where match(command_line, "(?i)-s") 
| where match(command_line, "(?i)/tmp/.*(onecli|xcl)") 
| table _time, host, user, process, command_line, parent_process
| search command_line IN ("/etc/passwd", "/etc/crontab", "/etc/shadow", "/root/.ssh/authorized_keys", "/etc/ld.so.preload")
| sort - _time

Wazuh OSSEC Rule

<group name="lenovo_onecli_cve_2026_16791,">
  <!-- Detect symlink creation to sensitive files with OneCLI temp pattern -->
  <rule id="100726" level="10">
    <decoded>auditd</decoded>
    <match>symlink|creat</match>
    <regex>onecli|OneCLI</regex>
    <regex>/tmp/</regex>
    <field name="key">(etc-passwd|etc-crontab|etc-shadow|root-ssh)</field>
    <description>Potential CVE-2026-16791 exploitation - symlink at predictable OneCLI temp path to sensitive file</description>
    <mitre>
      <id>T1490</id> <!-- Inhibit System Recovery -->
    </mitre>
    <group>pci_dss_6.5.1,gdpr_IV_35.7.d</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (before patch):

   • Restrict execution of OneCLI to trusted administrators only — remove sudo privileges for any non-admin users.
   • Implement a wrapper script that runs OneCLI with umask 077 and creates an isolated, per-run temporary directory owned by root with mode 0700 (e.g., TMPDIR=/tmp/onecli-runtime-$$; mkdir -m 700 $TMPDIR).
   • Monitor and alert on symlink creation in /tmp and /var/tmp when paired with OneCLI execution (see Detection Guidance above).
   • If OneCLI must run in a shared environment, consider temporarily mounting /tmp with noexec and nosuid (does not stop symlink attacks but reduces other risks).

2. Patch/Upgrade Steps:

   • Update the Linux version of Lenovo XClarity Essentials OneCLI to the version indicated in the Lenovo advisory (HT116433) or higher. The fixed version is expected to use secure temporary file creation (mkstemp/O_EXCL), effectively mitigating the symlink pre-creation attack.
   • Verify the patch independently: after applying, run strings $(which onecli) | grep -i mkstemp or conduct a controlled test to confirm temp files are created with unpredictable names (e.g., ls -l /tmp/ during operation).
   • Validate the advisory: confirm with Lenovo support or the CNA that the claimed fix addresses CWE-377 patterns specifically.

3. Long-Term Hardening:

   • Enforce a local policy requiring all system-management tools (Lenovo OneCLI, Dell RACADM, HP SUM) to use dedicated runtime directories (/var/run/<tool>/) with restrictive permissions, rather than /tmp.
   • Deploy SELinux/AppArmor profiles that constrain OneCLI's filesystem access to only necessary paths.
   • Implement file integrity monitoring (e.g., Auditd with -w /etc/passwd -p wa) for critical system files.
   • Regularly audit /tmp for unexpected symlinks (e.g., find /tmp -type l -ls).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16791
2. Lenovo Security Advisory: https://support.lenovo.com/us/en/solutions/ht116433
3. CWE-377 (Insecure Temporary File): https://cwe.mitre.org/data/definitions/377.html
4. ATT&CK Technique T1490 (Inhibit System Recovery) — relevant for impact assessment: https://attack.mitre.org/techniques/T1490/
5. EPSS Data (FIRST.org): https://www.first.org/epss/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence as of the publication date. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit primitive is publicly documented within the vulnerability class, and researchers have described analogous symlink attacks on similar vendor tools; however, no specific in-the-wild exploitation of CVE-2026-16791 has been observed.