Описание
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke getfacl or setfacl over an attacker-controlled path, potentially leading to local privilege escalation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | acl | Fix deferred | ||
| Red Hat Enterprise Linux 7 | acl | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat Enterprise Linux 10 | acl | Fixed | RHSA-2026:42739 | 21.07.2026 |
| Red Hat Enterprise Linux 8 | acl | Fixed | RHSA-2026:43420 | 22.07.2026 |
| Red Hat Enterprise Linux 9 | acl | Fixed | RHSA-2026:42736 | 21.07.2026 |
| Red Hat Enterprise Linux 9 | acl | Fixed | RHSA-2026:42736 | 21.07.2026 |
| Red Hat Discovery 2 | discovery/discovery-ui-rhel9 | Fixed | RHSA-2026:46836 | 27.07.2026 |
| Red Hat Hardened Images | acl-main-2.4.0-0.1.hum1 | Fixed | RHSA-2026:34351 | 01.07.2026 |
| Red Hat Update Infrastructure 5 | rhui5/cds-kubernetes-rhel9 | Fixed | RHSA-2026:44481 | 23.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCT ...
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
EPSS
6.3 Medium
CVSS3