Summary
A privilege escalation vulnerability in CUPS can let a local lpadmin user direct a root-privileged serial backend to write attacker-controlled print data to an arbitrary file. The issue becomes risky when the cups-filters serial backend is installed with root-only permissions and the user can configure printers.
Affected context
The vulnerability occurs in CUPS deployments using the cups-filters serial backend. It requires a locally authenticated user with lpadmin group membership, a serial backend executable available with root-only permissions, and a printer configuration that reaches a non-file device URI whose path is not adequately restricted by the scheduler.
Exploit preconditions
- Attack surface: Local CUPS printer configuration and job submission
- Required access: Local account with membership in the
lpadmingroup - Required component: A cups-filters serial backend installed with root-only execution permissions
- Trigger point: Processing print data through a configured serial printer backend
- Why exploitation is possible: The scheduler does not sufficiently constrain the path component of non-file device URIs, allowing a privileged backend to write attacker-controlled data to an unintended file
Why this happens
The underlying bug is a failure to enforce security boundaries around path components in non-file device URIs. CUPS permits a privileged serial backend to process a user-controlled destination that can resolve to an arbitrary filesystem path, allowing a lower-privileged administrator to influence root-owned file writes. This maps to CWE-269: Improper Privilege Management, because privileged functionality is exposed without sufficiently restricting how lower-privileged input controls its operations.
Potential impact
- Arbitrary modification of security-sensitive CUPS configuration
- Persistence through altered service or printing configuration
- Execution of code with root privileges
- Compromise of the local host
- Possible manipulation of print jobs or related system data
General mitigation guidance
Mitigation generally focuses on enforcing strict privilege boundaries between printer configuration and backend file operations.
Common defensive patterns include:
- Restricting non-file device URI paths to approved device locations
- Canonicalizing and validating paths before any privileged filesystem operation
- Separating untrusted print data handling from root-owned configuration paths
- Running backends with the minimum privileges required for their device operations
- Limiting lpadmin membership to trusted administrators
- Applying restrictive filesystem permissions and service confinement policies
- Disabling unused serial backends where they are not required
These controls reduce the chance that privileged backend behavior can be redirected toward sensitive files.
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis of URI parsing and path validation in privileged backends
- Code review checks for privileged file writes influenced by printer configuration
- Tests that verify non-file URI paths cannot escape approved device directories
- Monitoring changes to CUPS printer definitions and security-sensitive configuration files
- Auditing lpadmin group membership and backend executable permissions
- Policy enforcement that restricts privileged services from writing outside explicitly allowed paths
Automated security review tools may help identify missing canonicalization, insufficient allowlists, and privilege-boundary violations.
