shutil.copy2 race condition leading to local file disclosure
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 45/100
- Issue 類型
- 缺陷
- 描述清晰度
- 基本清楚
- 活躍度
- 冷清
- 技術堆疊
- python
研究方向
首先檢查 Lib/shutil.py 第 434 行附近的程式碼以及連結的 raceread proof of concept，重點關注 POSIX 上複製和權限處理的順序。當回報的本機檔案洩漏在受影響的 POSIX 情況下不再能夠重現，並且已根據 issue 的情境驗證行為時，即表示完成。
由索引模型根據 Issue 內容生成。
描述
Bug report
shutil.copy2 first copies the contents (creating the file with default permissions), then sets the permissions. This allows a local attacker that can read the directory to quickly grab the contents of the file before the permissions are changed. (This was reported to security@ on 2022-02-04 and has now been publicly disclosed - the link has some extra detail. Creating the bug here as directed.)
Source code: https://github.com/python/cpython/blob/3.10/Lib/shutil.py#L434
Note that changing the permissions after file creation but before writing content is insufficient: if the file is created with permissions that allow the attacker to open it, the attacker can get a file handle for the (empty) file. Under POSIX, the handle remains valid and readable even if the permissions change, allowing the attacker to read the file contents when they're populated. (@tiran, please feel free to add the info from your security@ response.)
I've confirmed that this is reliably exploitable (if the file is being created in a directory that the attacker can read), proof of concept code is available in https://github.com/janschejbal/raceread/. This is relevant in practice due to questionable choices by some distributions, causing many home directories to be created with permissions 755, i.e. world-readable (Ubuntu only changed that in 21.04).
Your environment
I've tested this on Python 3.8.10 on Ubuntu 20.04.3 LTS, but I believe it to affect all versions on any POSIX-compliant platform.
- 主要語言
- Python
- 星號
- 77.2k
- 分支
- 36k
- 平均合併
- 1 天 9 小時
- 30 天內合併 PR
- 558
貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
python/cpython 的其他 Issue
-
docs pending
難度 2/5 1-3 小時 新手友好度 78/100
-
stdlib type-feature
難度 2/5 1-3 小時 新手友好度 78/100
-
stdlib type-feature
難度 2/5 1-3 小時 新手友好度 72/100
-
build type-bug
難度 2/5 1-3 小時 新手友好度 76/100
-
stdlib topic-email type-feature
難度 2/5 1-3 小時 新手友好度 70/100
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 90/100
-
bug
難度 2/5 1-3 小時 新手友好度 86/100
zostera/django-bootstrap4#894 ·
-
難度 2/5 1-3 小時 新手友好度 78/100
use-agent-os/agent-os#3276 ·
-
難度 2/5 1-3 小時 新手友好度 88/100
zephyrproject-rtos/zephyr#119726 ·
-
area/auth bug comp/agent P3 platform/discord type/security
難度 2/5 1-3 小時 新手友好度 88/100
NousResearch/hermes-agent#117848 ·