CyberSecBulletin
CVE-2024-43882NVD status: Modified

Linux: Time-of-check Time-of-use (TOCTOU) Race Condition

Published Updated By the CyberSecBulletin desk

CVE-2024-43882 is a high-severity time-of-check time-of-use (TOCTOU) race condition vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d5c3c7e26275a2d83b894d30f7582a42853a958f, 368f6985d46657b8b466a421dddcacd4051f7ada, 15469d46ba34559bfe7e3de6659115778c624759 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d5c3c7e26275a2d83b894d30f7582a42853a958f or 368f6985d46657b8b466a421dddcacd4051f7ada or 15469d46ba34559bfe7e3de6659115778c624759 or 9b424c5d4130d56312e2a3be17efb0928fec4d64, whichever matches your release line, or a later version.
  2. Update RUGGEDCOM RST2428P to V3.1 or a later version.
  3. Update SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.1 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, d5c3c7e26275a2d83b894d30f7582a42853a958f; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, 368f6985d46657b8b466a421dddcacd4051f7ada; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, 15469d46ba34559bfe7e3de6659115778c624759; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, 9b424c5d4130d56312e2a3be17efb0928fec4d64; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, d2a2a4714d80d09b0f8eb6438ab4224690b7121e; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, 90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e; 9167b0b9a0ab7907191523f5a0528e3b9c288e21 up to, but not including, f50733b45d865f91db90919f8311e2127ce5a0cb; and 1 more rangesd5c3c7e26275a2d83b894d30f7582a42853a958f, 368f6985d46657b8b466a421dddcacd4051f7ada, 15469d46ba34559bfe7e3de6659115778c624759, 9b424c5d4130d56312e2a3be17efb0928fec4d64, f6cfc6bcfd5e1cf76115b6450516ea4c99897ae1, d2a2a4714d80d09b0f8eb6438ab4224690b7121e
SiemensRUGGEDCOM RST2428Pbefore V3.1V3.1
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familyNot specified in the recordNot stated
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.1V3.1
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
LinuxLinux Kernelbefore 4.19.320; 4.20 up to, but not including, 5.4.282; 5.5 up to, but not including, 5.10.224; 5.11 up to, but not including, 5.15.165; 5.16 up to, but not including, 6.1.106; 6.2 up to, but not including, 6.6.47; 6.7 up to, but not including, 6.10.6; 6.114.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.106, 6.6.47

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighNVD
CVSS 3.18.4HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod, and when the chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid to root, violating the expressed authorization of "only cdrom group members can setuid to root". Re-check that we still have execute permissions in case the metadata has changed. It would be better to keep a copy from the perm-check time, but until we can do that refactoring, the least-bad option is to do a full inode_permission() call (under inode lock). It is understood that this is safe against dead-locks, but hardly optimal.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

How developers prevent this class of flaw

  • The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
  • When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
  • Limit the interleaving of operations on files from multiple processes.

More Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities (CWE-367)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities

Spotted an error? Tell us.