Filelock ReadWriteLock Race Condition Local Privilege Escalation

Executive Summary

This vulnerability affects the filelock Python library versions 4.1.0 to 4.2.1. It involves the ReadWriteLock feature which uses private hard-link directories for locking. An attacker with rename access in a non-sticky parent directory can manipulate the .filelock-* directory name, causing the victim's process to delete their own directory tree during lock cleanup. This happens because the cleanup process does not verify the directory path before deletion.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses filelock versions 4.1.0 to 4.2.1. Run 'pip show filelock' to verify the installed version. Inspect directories for .filelock-* folders and monitor for unexpected directory deletions or renames.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to data loss. An attacker could trick a victim's system into deleting their own directories when releasing a file lock. This requires the attacker to have write permissions in a shared directory where the victim's lock files are stored. The impact is high integrity loss as data is destroyed without warning.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later using 'pip install --upgrade filelock'. Ensure directories containing .filelock-* entries have sticky bits set to prevent unauthorized renames.

Useful 0 Not Useful 0