U - mkfifogood first issuereported-canonical
Metriche repository
- Star
- (23.246 star)
- Metriche merge PR
- (Merge medio 9g 14h) (216 PR mergiate in 30 g)
Descrizione
Component
mkfifo
Description
mkfifo creates a FIFO and then unconditionally performs a path-based chmod via std::fs::set_permissions.
Between these operations, an attacker with write access to the containing directory can replace the FIFO with a symlink.
Additionally, for the default case (no -m flag), the chmod is redundant as the kernel already applies umask during creation.
Test / Reproduction Steps
# Terminal 1 (attacker, racing the chmod):
while true; do
rm -f /tmp/fifo; ln -s /etc/shadow /tmp/fifo
done
# Terminal 2 (victim with privileges):
while true; do
rm -f /tmp/fifo; mkfifo -m 0666 /tmp/fifo
done
# Check if /etc/shadow permissions changed