1232942 - [CID 1213980] NSS TOCTOU

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Franziskus Kiefer [:franziskus]]

os_stat(dbname, &stat_existing) and usage of dbname/file_mode in the following code yield possible TOCTOU.

utilmod.c:503
>   /* get the permissions of the existing file, or use the default */
>    if (!os_stat(dbname, &stat_existing)) {
>	file_mode = stat_existing.st_mode;
>    } else {
>	file_mode = os_open_permissions_default;
>    }
> 
>    /* do we really want to use streams here */
>    fd = fopen(dbname, "r");
>    if (fd == NULL) goto loser;
> 
>    fd2 = lfopen(dbname2, lfopen_truncate, file_mode);

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I don't think this is a problem. At worst something could get the wrong permissions, but if an attacker could modify file permissions, they can do much worse.

Comment 2

[Franziskus Kiefer [:franziskus]]

I agree with David. Marking this as false positive.