Executive brief
LiME is a Linux kernel module used for forensic memory acquisition. The tool fails to safely validate output file paths when writing memory dumps to disk, allowing an unprivileged local attacker to create a symbolic link that LiME will follow and overwrite arbitrary root-owned files. In demonstrated attacks, this can lead to privilege escalation or data destruction.
Technical details
LiME opens the operator-supplied disk acquisition output path using filp_open() with flags O_WRONLY | O_CREAT | O_TRUNC | O_LARGEFILE but omits O_NOFOLLOW and performs no post-open validation, allowing symlink following. An unprivileged attacker who controls the output directory can pre-position a symbolic link with the expected filename pointing to any root-owned file; when LiME executes in kernel/root context, it follows the symlink and truncates the target. Additionally, newly created disk-acquisition files are opened with mode 0444, making memory dumps world-readable and exposing secrets in physical memory. The vulnerability is exploitable on systems with fs.protected_symlinks disabled or on writable external storage (e.g., Android /sdcard). Patches are available in updated versions of LiME.
Affected products
- jtsylve LiME through 1.12.0
Timeline
- 2026-09-03: disclosed
- 2026-09-03: advisory