Description
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nano | 2.2.4-1 | — |
| Debian 13 | nano | 2.2.4-1 | — |
| Debian 12 | nano | 2.2.4-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nano | 2.7.1-1.1 | openSUSE-SU-2024:10435-1 |
Advisories 1
- openSUSE-SU-2024:10435-1 nano-2.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [Nano-devel] 20100407 New prerelease for security tweaks mailing-list
- http://svn.savannah.gnu.org/viewvc/trunk/nano/ChangeLog?revision=4503&root=nano&view=markup
- [oss-security] 20100414 CVE request: GNU nano (minor) mailing-list
- 1023891 vdb-entry
- http://drosenbe.blogspot.com/2010/03/nano-as-root.html
- 39444 third-party-advisory