Race Condition Vulnerability in GNU Coreutils
Summary
CVE-2017-18018: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbi... Affects coreutils across 2 version ranges.
< 8.30-r0
< 27b2b19aa8d8b30b8cb4198b2f4b54568e10a35e
Fixed in 8.30-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Coreutils is a collection of fundamental utilities for Unix-like operating systems. It provides essential commands for file management, text processing, shell scripting, and more. The package is widely used and forms the backbone of many Linux distributions. However, a race condition vulnerability has been discovered in the chown and chgrp commands, which are part of GNU Coreutils.
Vulnerability Detail
The vulnerability, identified as CVE-2017-18018, exists in GNU Coreutils versions up to 8.29. Specifically, the chown-core.c file in chown and chgrp does not prevent the replacement of a plain file with a symlink when using the POSIX "-R -L" options. This flaw can be exploited by local users to modify the ownership of arbitrary files by leveraging the race condition. By manipulating the timing of operations, an attacker can trick the system into changing the ownership of a file to which they should not have access. This could lead to unauthorized modification, disclosure, or destruction of sensitive data.
How To Fix
Minimum fixed version
8.30-r0
This is the first release that contains the fix.
sudo apk add --upgrade coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the "-R -L" options with the chown and chgrp commands. Instead, they can manually specify the target files or directories without using recursive or symbolic link following options. By doing so, the race condition vulnerability can be mitigated. However, this workaround may not be practical in situations where recursive operations or symbolic link handling is necessary.
Conclusion
The race condition vulnerability in GNU Coreutils can be addressed by updating to version 8.30-r0 or later. Users should ensure they have the latest version installed to prevent unauthorized ownership modifications. It is recommended to regularly update software packages to stay protected against known vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coreutils →
FAQ
GNU Coreutils is a collection of essential utilities for Unix-like operating systems, providing commands for file management, text processing, shell scripting, and more.
The vulnerability affects GNU Coreutils versions up to 8.29. Versions 8.30-r0 and later include the necessary fixes.
Local users can exploit the race condition vulnerability by manipulating the timing of operations in the chown and chgrp commands. This allows them to modify the ownership of arbitrary files, potentially leading to unauthorized access or data manipulation.
The vulnerability could result in unauthorized modification, disclosure, or destruction of sensitive data. Attackers could gain access to files they should not have ownership of, potentially compromising the integrity and confidentiality of the affected system.
Yes, users can avoid using the "-R -L" options with the chown and chgrp commands to mitigate the race condition vulnerability. However, this workaround may not be practical in certain scenarios.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
