Bug 908038 (CVE-2023-30571)

Summary:	app-arch/libarchive: race condition leading to world writable directory creation
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor	CC:	allenwebb, mgorny
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/libarchive/libarchive/issues/1876
Whiteboard:	A4 [upstream]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-06-08 04:32:43 UTC

CVE-2023-30571:

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

Comment 1 John Helmert III archtester

2023-07-14 04:42:47 UTC

Hm, looks like this will just end up being a documentation fix.