Executive Summary

This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the mkfifo utility of uutils coreutils. The utility first creates a FIFO (named pipe) and then changes its permissions using a path-based chmod operation. A local attacker who has write access to the parent directory can exploit the time gap between these two operations by replacing the newly created FIFO with a symbolic link pointing to an arbitrary file. As a result, the chmod command modifies the permissions of the targeted file instead of the FIFO, potentially allowing the attacker to escalate privileges if the utility is executed with elevated rights.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker with write access to the parent directory to escalate their privileges on the affected system. By exploiting the race condition, the attacker can change permissions on arbitrary files, potentially gaining unauthorized access or control. This can lead to compromise of system integrity, confidentiality, and availability, especially if the mkfifo utility is run with elevated privileges.

Useful 0 Not Useful 0