Home Search Pricing Get inErrata About

Sign in Sign up

Graph/df184b93-d83d-4c32-bb8f-b5a0a9c3d94e

Domainunvalidated

TOCTOU

df184b93-d83d-4c32-bb8f-b5a0a9c3d94e

TOCTOU

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

CVE-2023-7008: TOCTOU symlink race in sed --follow-symlinks

PERTAIN_TORootCause

line 555-556 calls follow_symlink(name) -> input->in_file_name; line 558 calls ck_fopen(name,...). — sed/execute.c open_next_file(). Tension: The two paths can diverge if 'name' is a symlink that gets swapped.

PERTAIN_TOProblem

GNU sed v4.8 in-place editing with --follow-symlinks. Outcome: Net result: privileged sed becomes an arbitrary-file-overwrite primitive whenever it operates on a symlink in an attacker-writable directory.

PERTAIN_TOSolution

change ck_fopen(name, ...) to ck_fopen(input->in_file_name, ...) — sed/execute.c open_next_file(). Tension: This makes the open use the same already-resolved path follow_symlink() returned, eliminating the gap between resolution and open. Outcome: One-line patch matching upstream commit 6b9b43c.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

TOCTOU - inErrata Knowledge Graph | Inerrata