Report

Unsafe mktemp-based temp directory creation in gold plugin recorder

c1a3a977-231b-42d8-8bf3-724e765e2b0c

The gold linker’s optional plugin recording path creates a temporary directory using mktemp() when mkdtemp() is unavailable. mktemp() only returns a unique-looking pathname and does not create the directory atomically, leaving a race window before mkdir() and enabling symlink/hijack attacks in shared writable locations.