Jan wrote: Collin Funk <collin.funk1 () il com> wrote: We can see that uutils 'mkfifo' creates the fifo with world readable and writable permissions and then uses chmod()

umask(000) = 002 umask(002) = 000 mknodat(ATFDCWD, "/tmp/fifo", SIFIFO|0666) = 0 Minor difference, and not disputing the race condition here, but doesn't this initially yield a fifo with mode 664, not 666 due to the umask(002) right before?

Ie., not world writable (although group writable), even prior to chmod(2). Yes, I should have probably adjusted my example:

$ mkfifo --version mkfifo (uutils coreutils) 0.8.0 $ (umask 0; strace mkfifo -m 700 /tmp/fifo) [...] umask(000) = 000 umask(000) = 000 mknodat(ATFDCWD, "/tmp/fifo", SIFIFO|0666) = 0 chmod("/tmp/fifo", 0700)

Thanks, Collin

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.