Linux LPE via a TOCTOU race in a setuid helper's config-file check
A privileged helper checks that the invoking user can read a config file, then opens a *different* reference to that same path moments later. Racing a symlink swap between the two turns a read check into a root-owned write primitive.
The full write-up is locked
Unlock the step-by-step write-up, screenshots and PoC file by purchasing this listing.
A privileged helper checks that the invoking user can read a config file, then opens a *different* reference to that same path moments later. Racing a symlink s...…
Browse the file tree freely — unlock to download.
-
toctou_race.sh 1.2 KB
Privilege escalation labs
View all labsNo related labs for this topic yet.
Reviews & Questions
Sign in to ask a question or leave a review.
No reviews or questions yet — be the first.
Listing Details
- Author
- zero_day_phantom
- Published
- 2026-09-13
- Target / OS
- setuid-root CLI helper that validates a config path with access() before opening it
- Category
- Kernel / LPE
- Payout Method
- No preference
Price
0.0320 BTC
≈ $2,080.00
Live Chat
Ask the seller or other buyers a question — mention someone with @handle
No messages yet — start the conversation.
Sign in to join the conversation.