Filelock ReadWriteLock Symlink Race Condition in Python

Executive Summary

This vulnerability affects the filelock library versions 3.20.4 to 4.2.0. It involves the ReadWriteLock and AsyncReadWriteLock components which use SQLite for locking. The issue occurs because SQLite reopens the lock database by name instead of file descriptor, allowing attackers with local access to manipulate symlinks or create malicious journal files. This can lead to file overwrites, unlinks, permission changes, or denial-of-service conditions.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses filelock versions 3.20.4 to 4.2.0 by running: pip show filelock. If installed, verify the version matches the vulnerable range. Inspect directories with lock files for unexpected symlinks or journal files like -wal, -journal, or -shm. Use commands like ls -la /tmp or find / -type l to detect suspicious symlinks.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to overwrite or delete your files, change file permissions, or cause your applications to crash. It requires the attacker to have local access to a directory where the lock database is stored, such as a non-sticky or group-writable directory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file modifications or deletions, potentially violating data integrity and availability requirements in GDPR and HIPAA. Unauthorized access or data loss may result in non-compliance with these regulations, leading to legal and financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later using pip install --upgrade filelock. Ensure directories containing lock files are sticky (e.g., chmod +t /tmp) or restrict write permissions to prevent unauthorized access. Avoid using non-sticky shared directories for lock files.

Useful 0 Not Useful 0