Many common operating systems such as Windows and UNIX support file links, including hard links, symbolic (soft) links, and virtual drives. Hard links can be created in UNIX with the
ln command or in Windows operating systems by calling the
CreateHardLink() function. Symbolic links can be created in UNIX using the
ln -s command or in Windows by using directory junctions in NTFS or the Linkd.exe (Win 2K resource kit) or "junction" freeware. Virtual drives can also be created in Windows using the
File links can create security issues for programs that fail to consider the possibility that the file being opened may actually be a link to a different file. This is especially dangerous when the vulnerable program is running with elevated privileges.
Frequently, there is no need to check for the existence of symbolic links because this problem can be solved using other techniques. When opening an existing file, for example, the simplest solution is often to drop privileges to the privileges of the user. This solution permits the use of links while preventing access to files for which the user of the application is not privileged.
When creating new files, it may be possible to use functions that create a new file only where a file does not already exist. This prevents the application from overwriting an existing file during file creation. (See FIO03-C. Do not make assumptions about fopen() and file creation.)
In rare cases, it is necessary to check for the existence of symbolic or hard links to ensure that a program is reading from an intended file and not a different file in another directory. In these cases, avoid creating a race condition when checking for the existence of symbolic links. (See POS35-C. Avoid race conditions while checking for the existence of a symbolic link.)
Noncompliant Code Example
This noncompliant code example opens the file specified by the string
file_name for read/write access and then writes user-supplied data to the file:
If the process is running with elevated privileges, an attacker can exploit this code, for example, by replacing the file with a symbolic link to the
/etc/passwd authentication file. The attacker can then overwrite data stored in the password file to create a new root account with no password. As a result, this attack can be used to gain root privileges on a vulnerable system.
Compliant Solution (Linux 2.1.126+, FreeBSD, Solaris 10, POSIX.1-2008
Some systems provide the
O_NOFOLLOW flag to help mitigate this problem. The flag is required by the POSIX.1-2008 standard and so will become more portable over time [Open Group 2008]. If the flag is set and the supplied
file_name is a symbolic link, then the open will fail.
Note that this compliant solution does not check for hard links.
Compliant Solution (
This compliant solution uses the
fstat idiom illustrated in FIO05-C. Identify files using multiple file attributes:
This code is still subject to a time-of-check, time-of-use (TOCTOU) race condition, but before doing any operation on the file, it verifies that the file opened is the same file as was previously checked (by checking the file's device and i-node.) As a result, the code will recognize if an attacker has tampered with the file during the race window and can operate accordingly.
Note that this code does not check for hard links.
Hard links are problematic because if a file has multiple hard links, it is impossible to distinguish the original link from one that might have been created by a malicious attacker.
One way to deal with hard links is simply to disallow opening of any file with two or more hard links. The following code snippet, when inserted into the previous example, will identify if a file has multiple hard links:
Because a hard link may not be created if the link and the linked-to file are on different devices, many platforms place system-critical files on a different device from the one where user-editable files are kept. For instance, the
/ directory, which contains critical system files like
/etc/passwd, would live on one hard drive, while the
/home directory, which contains user-editable files, would reside on a separate hard drive. This prevents users, for example, from creating hard links to
Failing to check for the existence of links can result in a critical system file being overwritten, leading to data integrity violations.
Could report possible violations of this rule by flagging calls to
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
|MITRE CWE||CWE-59, Failure to resolve links before file access (aka "link following")|
CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367, Time-of-check, time-of-use (TOCTOU) race condition