Insecure Temporary File Handling in GNU gzip gzexe Utility

Executive Summary

The vulnerability exists in the GNU gzip utility called gzexe, which handles temporary files insecurely when the mktemp utility is not available in the user's PATH.

In this case, gzexe creates a temporary file path based only on the process ID (PID), which is predictable and lacks exclusive access or existence checks.

A local attacker can exploit this by pre-creating the predicted temporary file path as a symbolic link to an arbitrary file writable by the victim.

When gzexe runs, it follows the symlink and overwrites the target file, causing a time-of-check to time-of-use (TOCTOU) race condition that allows arbitrary file overwrite.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to overwrite arbitrary files by exploiting the predictable temporary file naming and symbolic link manipulation.

Such arbitrary file overwrite can lead to unauthorized modification or corruption of files, potentially causing system instability, data loss, or privilege escalation depending on which files are overwritten.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the gzexe utility in GNU gzip creating temporary files insecurely when the mktemp utility is not available in the user's PATH. Detection would involve checking if mktemp is missing and if gzexe is using a fallback method that creates predictable temporary filenames based on the process ID.

You can check if mktemp is available by running the command: `which mktemp` or `command -v mktemp`. If mktemp is not found, the system might be vulnerable if it uses an unpatched version of gzexe.

To verify the version or patch status of gzip, you can check the installed gzip version or inspect the gzexe script for the presence of the safe fallback method (using umask 77 and set -C). For example, you might run: `gzip --version` or inspect the gzexe script source.

Since the vulnerability is local and related to file creation race conditions, network detection is not applicable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update GNU gzip to a version that includes the fix from commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269.

This fix ensures that temporary files are created safely by using a combination of umask 77 and set -C to prevent overwriting existing files, even when mktemp is unavailable.

If updating is not immediately possible, ensure that the mktemp utility is available in the PATH to avoid the insecure fallback method.

Additionally, restrict local user permissions to prevent untrusted users from creating symbolic links or files in directories where gzexe creates temporary files.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not include information about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0