Executive brief
GLib2 is a core utility library used by many Linux applications to handle file operations. A flaw in the file replacement function can allow a local attacker with write access to a directory to redirect file writes to unintended locations. An attacker could overwrite files that the vulnerable application is authorized to modify, potentially compromising data integrity or enabling privilege escalation.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) symlink race condition (CWE-59) in GLib2's g_file_replace() function when called with G_FILE_CREATE_REPLACE_DESTINATION flag. When the temporary file creation fails, the library unlinks the destination file and recreates it without proper exclusive creation or symlink protection. An attacker with write access to the destination directory can exploit this race condition to redirect the write to another file. Exploitation requires specific conditions: local access, directory write permissions, use of the uncommon temp-file fallback path, and successfully winning a tight race. A successful exploit allows overwriting or creating files that the victim process is permitted to access.
Affected products
- GNOME GLib2 <UNKNOWN>
Timeline
- 2026-09-07: disclosed