Executive brief
LightFTP is a lightweight file transfer server used to share files over a network. A flaw in how the server manages internal connections allows a remote attacker to cause the service to crash by timing specific requests. This results in a denial-of-service, preventing legitimate users from accessing or transferring files until the server is manually restarted.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in LightFTP version 2.3.1 and earlier. The vulnerability occurs when a fresh connection reuses an FTP context while an ABRT cleanup is simultaneously in progress. Specifically, an unprotected re-check of WorkerThreadId occurs between the worker_thread_cleanup() and pthread_join() functions outside of the MTLock mutex. This allows an attacker to cause pthread_join() to operate on an invalid thread ID, triggering a server crash. This issue represents an incomplete fix for a previously identified vulnerability (CVE-2024-11144). Exploitation requires high timing precision but no authentication.
Affected products
- hfiref0x LightFTP <= 2.3.1
Timeline
- 2026-07-31: advisory: NVD and VulnCheck published the advisory