Executive brief
mport is MidnightBSD's package manager, responsible for installing software on the system. Prior to version 2.7.8, a local attacker with write access to package installation directories could exploit a race condition to swap installed files with symlinks, causing the package manager to apply ownership and permission changes to attacker-selected files on the system. This could compromise filesystem permissions and integrity, potentially enabling privilege escalation for packages installed into world-writable directories.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in do_actual_install() within libmport/bundle_read_install_pkg.c. The installer used path-based lstat(), chown(), stat(), and chmod() operations in sequence when applying ownership and permission metadata to extracted package files. An attacker with write access to a target directory could replace a regular file with a symlink between the lstat() check and the chown()/chmod() calls, causing the privileged operations to follow the symlink and modify an arbitrary file. The fix hardens the code by opening extracted files with O_NOFOLLOW and using descriptor-based fstat(), fchown(), and fchmod() operations instead, preventing symlink traversal and closing the race window. Version 2.7.8 and later include this fix.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-05-31: disclosed
- 2026-05-31: patched: Fix merged in commit 4676ac0; version 2.7.8 released
- 2026-09-17: advisory