Description
TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| antirez | linenoise | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | redis6 +2 | 6.2.14-2.amzn2023.0.7 | ALAS2023-2025-1195 |
Advisories 1
- ALAS2023-2025-1195 Moderate: redis6 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 29, 2025