42 lines
1.5 KiB
Markdown
42 lines
1.5 KiB
Markdown
---
|
|
id: "bug-1861"
|
|
status: "fixed"
|
|
status_updated: "2026-09-25"
|
|
status_note: "b5d59253"
|
|
component: "controller"
|
|
severity: "unknown"
|
|
timestamp: "2026-09-24T15:05:56Z"
|
|
last_seen: "2026-09-24T15:05:56Z"
|
|
occurrences: 1
|
|
files: ["src/controller/config_repl.c"]
|
|
tags: ["controller", "security", "tmpfile", "config-upgrade"]
|
|
related: []
|
|
fix_commits: ["b5d59253"]
|
|
legacy: true
|
|
gitea_issue: 280
|
|
gitea_synced_status: "fixed"
|
|
gitea_synced_hash: "06b29e927501"
|
|
---
|
|
|
|
# bug-1861: config_repl.c do_upgrade_config_with_bytes: temp decode file…
|
|
|
|
## Description
|
|
config_repl.c do_upgrade_config_with_bytes: temp decode file /tmp/xce_upgrade_cfg.<pthread_self()>.tmp -- the name is identical across processes (parallel controller_unit_test instances failed handle_upgrade_config with -EINVAL, 'a majority-acked upgrade must succeed') and is opened O_CREAT|O_TRUNC without O_EXCL in world-writable /tmp
|
|
|
|
## Environment
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Reproduction
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Root cause
|
|
pthread_self() is a thread-descriptor address, not a unique id: the main thread's value repeats across processes (esp. with ASLR off under ASAN), so two processes on one host share and clobber the file; a predictable name opened without O_EXCL in /tmp is also a symlink-attack target (write/truncate through an attacker's link).
|
|
|
|
## Fix
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Verification
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## References
|
|
- Gitea: #280
|