4 ms·
> if you were to try to "exploit" it the only thing that would happen is you get a different error message Can't reproduce this. If I do sudo strace -e in
by oguz-ismail 2y ago
> if you were to try to "exploit" it the only thing that would happen is you get a different error message
Can't reproduce this. If I do
sudo strace -e inject=stat:delay_exit=30s:when=2 ./coreutils more foo
on one terminal and
rm foo
ln -s /etc/passwd foo
on another, I can see the contents of /etc/passwd on the first one.
- IshKebab 2y agoUhm yeah well now try ln -s /etc/passwd foo sudo more foo OMG! The original version is "vulnerable" too! (I did not know about that strace feature though - that is very cool, thanks!)
- oguz-ismail 2y agoI thought I was gonna see an error because the stat'd file and the opened one didn't match. How disappointing
- IshKebab 2y agoNo, it just means you're checking the wrong file so you might not get the nice error message from the initial check. It's still not going to do anything incorrect when it comes to actually open the file though. TOCTOU only matters when the check is actually checking something important. Here it isn't; it's just giving nicer error messages. If you bypass it you just lose those nice error messages. So it isn't a problem here.