Local Privilege Escalation in Kitty Terminal via TOCTOU Race Condition

Compliance Impact

The vulnerability in kitty's file transmission protocol allows a child process to write to arbitrary files by exploiting a TOCTOU race condition, potentially causing unauthorized file modifications.

Such unauthorized file writes could lead to data integrity issues, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of data integrity and prevention of unauthorized data modification.

However, the vulnerability does not involve privilege escalation or direct data confidentiality breaches, but the integrity loss could still pose compliance risks depending on the data affected.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can exploit a TOCTOU (Time-of-Check-Time-of-Use) race condition. Specifically, the issue arises because the file open call does not use the O_NOFOLLOW flag, allowing an attacker to create a symlink between the initial file validation and the actual file creation. This lets the attacker write to arbitrary files on the filesystem by redirecting writes through the symlink.

The vulnerability affects versions of kitty prior to 0.47.2 and allows bypassing the transfer confirmation prompt, potentially overwriting important files such as ~/.bashrc with the user's permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to high integrity loss by allowing an attacker to overwrite or corrupt arbitrary files on the filesystem. Although it does not escalate privileges, it can cause significant damage by modifying critical user files, potentially affecting system behavior or user environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a TOCTOU race condition in kitty's file transmission protocol where a child process can write to arbitrary files by exploiting symlink following during file creation.

Detection would involve monitoring for unauthorized file writes or modifications, especially to sensitive files like ~/.bashrc, that occur during file transmission operations in kitty versions prior to 0.47.2.

Since the issue is related to symlink exploitation, you can check for suspicious symlink creations or modifications in directories used by kitty during file transmission.

Specific commands are not provided in the resources, but general approaches include:

• Use filesystem monitoring tools like inotifywait to watch for symlink creation or file modifications in kitty's working directories.
• Check for unexpected changes to critical user files (e.g., ~/.bashrc) using commands like `ls -l ~/.bashrc` or `stat ~/.bashrc` to verify timestamps and ownership.
• Audit running processes and child processes spawned by kitty to detect suspicious activity.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade kitty to version 0.47.2 or later, where the vulnerability has been fixed by adding the O_NOFOLLOW flag to the file open call.

Until the upgrade can be applied, avoid using the file transmission feature in kitty or restrict its use to trusted environments to minimize risk.

Additionally, monitor for suspicious symlink creations and unauthorized file writes as a temporary detection measure.

Useful 0 Not Useful 0