CVE-2017-18018: TOCTOU race condition in coreutils chown -R -L (restricted_chown bypass)

CVE-2017-18018 is a TOCTOU (Time-of-Check-Time-of-Use) race condition in GNU coreutils chown/chgrp commands. When using 'chown -R -L' (recursive + follow all symlinks to directories), an attacker who controls files in the traversed directory can replace a regular file with a symlink to an arbitrary privileged file during the window between FTS stat and the actual chownat() syscall. This allows changing ownership of any file on the system.

Root cause: In restricted_chown() in src/chown-core.c (lines 222-223), when neither --from=OWNER (required_uid) nor --from=:GROUP (required_gid) is specified (both == -1), the function immediately returns RC_do_ordinary_chown, bypassing the entire safe path (open file → fstat → verify inode matches → fchown with file descriptor). This causes the caller change_file_owner() to use chownat() (line 438), a path-based syscall that follows symlinks, instead of the inode-safe fchown approach.

Files examined:

• src/chown-core.c (primary vulnerable file)
• src/chown.c (option parsing showing when affect_symlink_referent is set)

Key code paths:

1. In change_file_owner() (lines 270-499), when affect_symlink_referent=true and file is a symlink, fstatat() is called to dereference. Then restricted_chown() is called.
2. In restricted_chown() (lines 211-262), the early return at lines 222-223:

   if (required_uid == (uid_t) -1 && required_gid == (gid_t) -1)
       return RC_do_ordinary_chown;

   This bypasses open+fstat+inode-check+fchown for all invocations without --from.
3. Back in change_file_owner(), RC_do_ordinary_chown triggers (line 438):

   ok = (chownat (fts->fts_cwd_fd, file, uid, gid) == 0);

   chownat follows symlinks.

The TOCTOU window: FTS stats file → race: attacker replaces file with symlink → chownat follows symlink.

This is confirmed by the code comment at lines 419-427 which acknowledges the race condition but notes restricted_chown 'avoids' it — yet the early return at 222-223 means it never runs the safe path for normal chown invocations without --from.

Trigger: chown -R -L newowner /path/ (or chgrp -R -L equivalent) NOT triggered: chown -R (without -L, since FTS_PHYSICAL + dereference=0 sets affect_symlink_referent=false)

The vulnerability is clearly visible in the source:

1. restricted_chown() lines 222-223 bypass safe path for common case
2. Comment at lines 419-427 explicitly acknowledges the TOCTOU risk
3. The only protection (open+fstat+fchown) is skipped for all non-from invocations
4. chownat() is a symlink-following syscall