File Path Race Condition & How To Prevent It - bin 0x31

In this video we look at a typical race condition involving file paths. We learn about the renameat syscall to exploit it and also how to fix it.


-=[ 🔴 Stuff I use ]=-


-=[ ❤️ Support ]=-


-=[ 🐕 Social ]=-


-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

[joonasfi]

I really appreciate that you showed the way to fix this vulnerability also!! Very nice.

[PwnFunction]

Wow, didn't know about the swapping syscall !

[cybermagician]

I am surprised to see you uploading so many videos haha I hope you keep this up! love your content!

[AshnSilvercorp]

I'm extremely new to programming and still don't understand all of it. But this person is actively explaining code very well.

[mina]

Interestingly, file contents may also suffer from race condition. I believe it was Samsung TVs which would read in firmware upgrade files from USB stick to verify their signature and if that check passed then read the file again to apply the upgrade. Issue is that one can easily create a USB device which returns some contents on first read but something completely different on another.


By the way, this file path race is essentially the reason why one cannot setuid shell scripts.

[simonzelenski]

Awesome video. Never thought that race conditions on file paths would be a thing..
Hope you get well soon enough to enjoy Christmas!

[vladde]

haha, you upload informational content on par with the best tutorials online, and your worried you don't upload enough. get some well needed rest buddy!

[sreyanchakravarty]

I have been using file paths without doing anything. Now I know. Please keep making more videos like this.

[bap]

Out of all your videos, that's the first thing I geniunely didn't know about 🤩

[tesilia]

Deine Videos retten gerade meine Klausur!

[schrodyn]

Feel better man. Thanks for the video. Learned something new, as always from your channel.

[joecarter]

This is really cool, I've written similar racey file code before but never bothered to look into how you avoid it.

[perli]

I tried another approach, making a symlink to a empty file I have permissions to, breaking the readflag on an open() syscall and then pointing the symlink to the actual flag. This didnt work unfortunately, but I still learned stuff and you got me to do something, which is very lovely. Thank you.

[Ookamiraven]

It feels like Christmas, because so many new content! LOL. I appreciate your hard work LiveOverflow!

[theotherjim]

That was really interesting, even better that you showed how to prevent the race condition. Thank you!

[jrmiasmg]

A simple way to show modifications through time, you can use the command watch -n 1 <command> to execute a command each second to get the differences. Something like: ```watch -n 1 ls -lha```

[MrLeeFergusson]

A great explanation of a common and easy to overlook bug.

[mal-nrym]

Really cool trick. Somewhat the same concept is using mkfifo to 'pause' the race - if a program writes to a pipe it'll then wait till something reads from it, and if it tries to read it'll wait till something writes.

[elikelik]

Each video shows me, that I must no no have to learn more and more =D Thanks a lot for the explanation, and also for fixing part. It is really helpful.A few weeks ago I started to watch your binary series and now comes new episodes, they somehow filling each other. Really great recourse. Thanks again. By the way "Gute Beserrung" =) PS:I'm not a german, so hope I wrote it write =D

[badrelmazaz]

Thanks, it really helped me to perform a priv esc