mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-28 21:11:41 -09:00
d2b2dc49ab
Fixes the following vulnerability: - CVE-2025-68146 A Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. For more informations, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-68146 -18a9988008(cherry picked from commitd9c1379d1f) Signed-off-by: Thomas Perale <thomas.perale@mind.be>
28 lines
1.2 KiB
Diff
28 lines
1.2 KiB
Diff
From 4724d7f8c3393ec1f048c93933e6e3e6ec321f0e Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
|
|
Date: Mon, 15 Dec 2025 15:52:12 -0800
|
|
Subject: [PATCH] Fix TOCTOU symlink vulnerability in lock file creation (#461)
|
|
|
|
CVE: CVE-2025-68146
|
|
Upstream: https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
|
|
[thomas: Dropped the windows part of the patch]
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/filelock/_unix.py | 2 +-
|
|
src/filelock/_windows.py | 38 ++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 39 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/filelock/_unix.py b/src/filelock/_unix.py
|
|
index b2fd0f33..25cbeca6 100644
|
|
--- a/src/filelock/_unix.py
|
|
+++ b/src/filelock/_unix.py
|
|
@@ -38,7 +38,7 @@ class UnixFileLock(BaseFileLock):
|
|
|
|
def _acquire(self) -> None:
|
|
ensure_directory_exists(self.lock_file)
|
|
- open_flags = os.O_RDWR | os.O_TRUNC
|
|
+ open_flags = os.O_RDWR | os.O_TRUNC | os.O_NOFOLLOW
|
|
if not Path(self.lock_file).exists():
|
|
open_flags |= os.O_CREAT
|
|
fd = os.open(self.lock_file, open_flags, self._context.mode)
|