Executive brief
Dool is a system resource monitoring tool. When run with the "--devel" flag, it opens a log file without proper protections against symlinks, allowing a local attacker to redirect logging to overwrite sensitive files. If dool is run with elevated privileges, this could destroy or corrupt critical system files.
Technical details
The vulnerability is a symlink-following (CWE-59) issue in dool versions up to 1.3.8. When the "--devel" flag is used, dool opens a log file without the O_NOFOLLOW flag, which would prevent the kernel from following symlinks. A local attacker can create a malicious symlink at the expected log file path pointing to any sensitive file on the system. When dool writes to the log file, it instead truncates and overwrites the target file with log data. This is especially damaging if dool is run with elevated privileges (e.g., as root or via sudo), as the attacker gains the ability to corrupt or destroy files normally protected from their access. The fix was addressed in pull request #116.
Affected products
- scottchiefbaker Dool up to 1.3.8
Timeline
- 2026-08-27: disclosed
- 2026-06-18: patched: Fix merged in pull request #116