Bug 928062

Summary:	<sys-apps/coreutils-9.5: chmod -R TOCTOU vulnerability
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	base-system
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A3 [stable?]
Package list:		Runtime testing required:	---

Description Sam James archtester

2024-03-28 16:32:47 UTC

+* Noteworthy changes in release 9.5 (2024-03-28) [stable]
+
+** Bug fixes
+
+  chmod -R now avoids a race where an attacker may replace a traversed file
+  with a symlink, causing chmod to operate on an unintended file.
+  [This bug was present in "the beginning".]

Comment 1 Larry the Git Cow gentoo-dev

2024-03-28 16:44:21 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0c6b401ac90deb03374def0d840e944e4f9eaad9

commit 0c6b401ac90deb03374def0d840e944e4f9eaad9
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2024-03-28 16:36:49 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-03-28 16:36:49 +0000

    sys-apps/coreutils: add 9.5, drop 9.4_p20240326
    
    Bug: https://bugs.gentoo.org/928062
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-apps/coreutils/Manifest                                           | 4 ++--
 .../{coreutils-9.4_p20240326.ebuild => coreutils-9.5.ebuild}          | 0
 2 files changed, 2 insertions(+), 2 deletions(-)