cosmos72 / twin

Text mode window environment. A "retro" program for embedded or remote systems, that doubles as X11 terminal and text-mode equivalent of VNC server
Other
661 stars 39 forks source link

server: fix TOCTOU filesystem race condition #86

Open szsam opened 1 year ago

szsam commented 1 year ago

CreateAuth() opens a file and then, if the opening was successful, its permissions are changed with chmod. However, an attacker might change the target of the file name between the initial opening and the permissions change, potentially changing the permissions of a different file.

This can be avoided by using fchmod with the file descriptor that was received from opening the file. This ensures that the permissions change is applied to the very same file that was opened.

Also, we need to close the file if open() succeeds but fchmod() fails.

Reference: CWE-367