Symlink replacement is non-atomic (TOCTOU race window) #23

New issue

Closed

opened 2026-04-29 23:31:26 +02:00 by heiko · 0 comments

heiko commented

2026-04-29 23:31:26 +02:00

Owner

Summary

In cmd/cert-proxy-client/cert/cert.go:233-236, the symlink update is performed as:

_ = os.Remove(name)
err = os.Symlink(filepath.Base(infixed[name]), name)

Between Remove and Symlink there is a window where:

Readers get ENOENT (brief unavailability of cert/key files)
A local attacker with write access to the directory could place a symlink pointing elsewhere

Exploitation Scenario

A local attacker races the Remove/Symlink window and creates a symlink pointing to a world-readable location. The next cert-proxy-client run writes the private key through that symlink to the attacker-controlled path. Requires write access to the certbase directory.

Recommended Fix

Use atomic symlink replacement via rename:

tmpLink := name + ".tmp"
os.Remove(tmpLink)
os.Symlink(filepath.Base(infixed[name]), tmpLink)
os.Rename(tmpLink, name)  // atomic on most filesystems

This eliminates both the ENOENT window and the race condition.

## Summary In `cmd/cert-proxy-client/cert/cert.go:233-236`, the symlink update is performed as: ```go _ = os.Remove(name) err = os.Symlink(filepath.Base(infixed[name]), name) ``` Between `Remove` and `Symlink` there is a window where: 1. Readers get `ENOENT` (brief unavailability of cert/key files) 2. A local attacker with write access to the directory could place a symlink pointing elsewhere ## Exploitation Scenario A local attacker races the Remove/Symlink window and creates a symlink pointing to a world-readable location. The next cert-proxy-client run writes the private key through that symlink to the attacker-controlled path. Requires write access to the certbase directory. ## Recommended Fix Use atomic symlink replacement via rename: ```go tmpLink := name + ".tmp" os.Remove(tmpLink) os.Symlink(filepath.Base(infixed[name]), tmpLink) os.Rename(tmpLink, name) // atomic on most filesystems ``` This eliminates both the ENOENT window and the race condition.

heiko added the

security

label

2026-04-29 23:31:26 +02:00

heiko referenced this issue from a commit

2026-04-29 23:48:22 +02:00

docs: update Known Issues and file permissions in README

heiko referenced this issue from a commit

2026-05-17 23:17:24 +02:00

fix: atomic symlink replacement in cert client

heiko referenced this issue from a pull request that will close it,

2026-05-17 23:17:41 +02:00