Executive brief
NumPy is a widely-used Python library for numerical computing. Multiple test and utility modules used insecure temporary file creation, allowing a local attacker to overwrite arbitrary files via symlink manipulation. This could enable code execution or data loss on systems where NumPy is installed.
Technical details
The vulnerability stems from insecure use of mktemp() function in NumPy's test and utility modules (core/tests/test_memmap.py, core/tests/test_multiarray.py, f2py/f2py2e.py, and lib/tests/test_io.py). The mktemp() function only returns a filename without creating it, leaving a race condition window where a local attacker can create a symlink with the predicted name. When NumPy subsequently opens and writes to that path, the symlink causes arbitrary file writes to attacker-controlled locations. Attack requires local system access and privileges to create symlinks in shared temporary directories. The vulnerability was fixed in NumPy 1.8.1 by replacing mktemp() with secure alternatives like mkstemp().
Affected products
- NumPy NumPy before 1.8.1
Timeline
- 2014-02-05: disclosed
- 2014-02-06: patched
- 2022-05-14: advisory