shutil.copy2 race condition leading to local file disclosure

未关闭
#96,719 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
python
领域
operating-systems, security

调研方向

首先检查 Lib/shutil.py 第 434 行附近的代码以及链接的 raceread proof of concept，重点关注 POSIX 上复制和权限处理的顺序。当报告的本地文件泄露在受影响的 POSIX 情况下不再能够复现，并且已根据 issue 的场景验证行为时，即表示完成。

由索引模型根据 Issue 内容生成。

描述

stdlib type-bug type-security

Bug report

shutil.copy2 first copies the contents (creating the file with default permissions), then sets the permissions. This allows a local attacker that can read the directory to quickly grab the contents of the file before the permissions are changed. (This was reported to security@ on 2022-02-04 and has now been publicly disclosed - the link has some extra detail. Creating the bug here as directed.)

Source code: https://github.com/python/cpython/blob/3.10/Lib/shutil.py#L434

Note that changing the permissions after file creation but before writing content is insufficient: if the file is created with permissions that allow the attacker to open it, the attacker can get a file handle for the (empty) file. Under POSIX, the handle remains valid and readable even if the permissions change, allowing the attacker to read the file contents when they're populated. (@tiran, please feel free to add the info from your security@ response.)

I've confirmed that this is reliably exploitable (if the file is being created in a directory that the attacker can read), proof of concept code is available in https://github.com/janschejbal/raceread/. This is relevant in practice due to questionable choices by some distributions, causing many home directories to be created with permissions 755, i.e. world-readable (Ubuntu only changed that in 21.04).

Your environment

I've tested this on Python 3.8.10 on Ubuntu 20.04.3 LTS, but I believe it to affect all versions on any POSIX-compliant platform.

主要语言
Python
星标
77.2k
派生
36k
平均合并
1 天 9 小时
30 天内合并 PR
558

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

python/cpython 的其他 Issue

查看 python/cpython 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。