Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 928062 - <sys-apps/coreutils-9.5: chmod -R TOCTOU vulnerability
Summary: <sys-apps/coreutils-9.5: chmod -R TOCTOU vulnerability
Status: IN_PROGRESS
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A3 [stable]
Keywords:
Depends on: 933045
Blocks:
  Show dependency tree
 
Reported: 2024-03-28 16:32 UTC by Sam James
Modified: 2024-07-06 06:18 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-03-28 16:32:47 UTC
+* Noteworthy changes in release 9.5 (2024-03-28) [stable]
+
+** Bug fixes
+
+  chmod -R now avoids a race where an attacker may replace a traversed file
+  with a symlink, causing chmod to operate on an unintended file.
+  [This bug was present in "the beginning".]
Comment 1 Larry the Git Cow gentoo-dev 2024-03-28 16:44:21 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0c6b401ac90deb03374def0d840e944e4f9eaad9

commit 0c6b401ac90deb03374def0d840e944e4f9eaad9
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2024-03-28 16:36:49 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-03-28 16:36:49 +0000

    sys-apps/coreutils: add 9.5, drop 9.4_p20240326
    
    Bug: https://bugs.gentoo.org/928062
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-apps/coreutils/Manifest                                           | 4 ++--
 .../{coreutils-9.4_p20240326.ebuild => coreutils-9.5.ebuild}          | 0
 2 files changed, 2 insertions(+), 2 deletions(-)