René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"shutil.copy2 race condition leading to local file disclosure","articleBody":"# Bug report\r\n\r\nshutil.copy2 first copies the contents (creating the file with default permissions), then sets the permissions. This allows a local attacker that can read the directory to quickly grab the contents of the file before the permissions are changed. (This was reported to security@ on 2022-02-04 and has now been [publicly disclosed](https://github.com/janschejbal/raceread/blob/master/writeups/python.md) - the link has some extra detail. Creating the bug here as directed.)\r\n\r\nSource code: https://github.com/python/cpython/blob/3.10/Lib/shutil.py#L434\r\n\r\nNote that changing the permissions after file creation but before writing content is insufficient: if the file is created with permissions that allow the attacker to open it, the attacker can get a file handle for the (empty) file. Under POSIX, the handle remains valid and readable even if the permissions change, allowing the attacker to read the file contents when they're populated. (@tiran, please feel free to add the info from your security@ response.)\r\n\r\nI've confirmed that this is reliably exploitable (if the file is being created in a directory that the attacker can read), proof of concept code is available in https://github.com/janschejbal/raceread/. This is relevant in practice due to questionable choices by some distributions, causing many home directories to be created with permissions 755, i.e. world-readable (Ubuntu only [changed that in 21.04](https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/19533)).\r\n\r\n# Your environment\r\n\r\nI've tested this on Python 3.8.10 on Ubuntu 20.04.3 LTS, but I believe it to affect all versions on any POSIX-compliant platform.","author":{"url":"https://github.com/janschejbal","@type":"Person","name":"janschejbal"},"datePublished":"2022-09-09T17:29:45.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/96719/cpython/issues/96719"}