CVE-2022-48682 : In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary

In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

Published 2024-04-26 01:15:46

Updated 2024-10-27 22:35:01

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-48682

Please log in to view affected product information.

EPSS FAQ

0.02%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 2 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.0	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H	0.8	5.2	MITRE	2024-04-26
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: High

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

https://bugzilla.suse.com/show_bug.cgi?id=1200381

1200381 – AUDIT-FIND: fdupes: TOCTOU race allows arbitrary file deletion
https://github.com/adrianlopezroche/fdupes/blob/4b6bcde1b3eb1cebe87cd30814f7d6cf4ee46e95/fdupes.c

fdupes/fdupes.c at 4b6bcde1b3eb1cebe87cd30814f7d6cf4ee46e95 · adrianlopezroche/fdupes · GitHub
https://github.com/adrianlopezroche/fdupes/compare/v2.1.2...v2.2.0

Comparing v2.1.2...v2.2.0 · adrianlopezroche/fdupes · GitHub
https://github.com/adrianlopezroche/fdupes/commit/85680897148f1ac33b55418e00334116e419717f

Call stat() before deleting any file to ensure it's still the same file. · adrianlopezroche/fdupes@8568089 · GitHub

Jump to