REDHAT-BUG-2460018
nano creates ~/.local with mode 0777 instead of 0700. In permissive-umask environments (containers, CI), local attacker can race to inject malicious .desktop launcher. The subsequent mkdir for ~/.local/share correctly uses 0700. Affected: src/history.c lines 229-234. BZ#2455314. Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460018?
The severity of REDHAT-BUG-2460018 is considered moderate due to the potential for a local attacker to exploit the vulnerability.
How do I fix REDHAT-BUG-2460018?
To fix REDHAT-BUG-2460018, adjust the permissions of the ~/.local directory to 0700 after it is created.
What versions of GNU Nano are affected by REDHAT-BUG-2460018?
GNU Nano versions that create the ~/.local directory with mode 0777 are affected by REDHAT-BUG-2460018.
Can REDHAT-BUG-2460018 be exploited in container environments?
Yes, REDHAT-BUG-2460018 can be exploited in permissive-umask environments such as containers and continuous integration systems.
What is the impact of the vulnerability REDHAT-BUG-2460018?
The impact of REDHAT-BUG-2460018 allows a local attacker to race to inject a malicious .desktop launcher into the user's environment.