filelock ReadWriteLock and AsyncReadWriteLock Symlink Path Traversal

Executive Summary

This vulnerability affects the filelock Python library versions 3.20.4 to 4.0.8. It involves ReadWriteLock and AsyncReadWriteLock classes which resolve lock paths and pass them to SQLite without checking for symlinks. A local attacker with write access to the lock directory can create a symlink to redirect locks to other files, bypassing protections like fs.protected_symlinks.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses filelock versions between 3.20.4 and 4.0.8. Run: pip show filelock or pip list | grep filelock. Inspect lock directories for unexpected symlinks or files not owned by the intended user.

Useful 0 Not Useful 0

Impact Analysis

An attacker could cause your process to create, lock, or write to unintended files. This may lead to data corruption, broken mutual exclusion between processes, or allow multiple writers to access the same resource simultaneously. The impact includes empty files created by the victim, SQLite locks on other databases, or resource corruption.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.0.9 or later using pip install --upgrade filelock. Restrict write access to lock directories to trusted users only. Monitor for unusual file creation or locking in shared directories.

Useful 0 Not Useful 0