[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <21947218-b146-45f3-a2c1-90863e9e90b5@gmail.com>
Date: Thu, 25 Sep 2025 20:45:56 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com, VMware PSIRT
<vmware.psirt@...adcom.com>, Solar Designer <solar@...nwall.com>
Cc: John Wolfe <john.wolfe@...adcom.com>
Subject: Re: CVE-2025-22247 - Insecure file handling
vulnerability in open-vm-tools
On 9/25/25 01:38, VMware PSIRT wrote:
> [...]
>
> [...] However, as you can see we are performing
> realpath() check after we completed the open() but before we read
> anything from the file. So, there is no use of pathname after realpath()
> call here.
That does not close the race window.
An attacker can rename() a directory out of the way, plant a symlink
while you open() the file, then rename() the directory back into place
between your open() and realpath() calls.
While double-checking the man page to be sure that rename(2) will do
that, I found the renameat2(2) call with the RENAME_EXCHANGE flag, with
an example of swapping a symlink and a non-empty directory... this
appears to be a supported use...
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
