Description
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cpio | 2.5-8.RHEL4 | RHSA-2005:378 |
| RHEL 3 | cpio | 2.5-4.RHEL3 | RHSA-2005:378 |
Advisories 2
- RHSA-2005:378 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-846-1 cpio - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20050413 cpio TOCTOU file-permissions vulnerability mailing-list
- 17532 third-party-advisory
- 17123 third-party-advisory
- 15725 vdb-entry
- RHSA-2005:378 vendor-advisory
- 16998 third-party-advisory
- 13159 vdb-entry
- DSA-846 vendor-advisory
- USN-189-1 vendor-advisory
- SUSE-SR:2006:010 vendor-advisory
- 20117 third-party-advisory
- oval:org.mitre.oval:def:9783 vdb-entry signature
- oval:org.mitre.oval:def:358 vdb-entry signature
- RHSA-2005:806 vendor-advisory
- 18395 third-party-advisory
- 18290 third-party-advisory