Executive brief
A vulnerability exists in the 'acl' utility, which is used to manage file access permissions on Linux systems. A local attacker can exploit a timing issue to trick the system into changing permissions on sensitive files they shouldn't have access to. This could allow an unauthorized user to gain administrative privileges or access restricted data.
Technical details
A TOCTOU race condition exists in the acl package before version 2.4.0. The vulnerability occurs when a privileged process invokes getfacl, setfacl, or chacl on a path where a component is controlled by a local attacker. By replacing a pathname component with a symbolic link between the initial lstat() check and subsequent operations (such as stat, chown, chmod, acl_get_file, or acl_set_file), an attacker can redirect file access control list operations to arbitrary files. This allows for local privilege escalation by manipulating permissions on sensitive system files. The issue has been addressed in version 2.4.0.
Affected products
- acl project acl before 2.4.0
Timeline
- 2026-06-29: advisory
- 2026-06-29: disclosed