Skip to content

cp TOCTOU: symlink swap bypasses no-dereference intent #10017

Closed
Closed
cp TOCTOU: symlink swap bypasses no-dereference intent#10017
Labels
U - cpgood first issueFor newcomers!reported-canonical

Description

@sylvestre
sylvestre
opened on Jan 3, 2026

Component

cp

Description

uutils cp can be vulnerable to a classic TOCTOU as it decides whether the source is a symlink using lstat-style metadata, but later opens the source by path without O_NOFOLLOW.

An attacker who can mutate the source tree concurrently can replace a regular file with a symlink between the check and the open, causing cp to copy the symlink target’s contents.

Test / Reproduction Steps

Evidence via strace to make it easier:

  • In uutils, cp opens the source without O_NOFOLLOW:
    openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC) (no O_NOFOLLOW)
  • In GNU cp on Linux, the equivalent open includes O_NOFOLLOW:
    openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_NOFOLLOW)

Preconditions: attacker can modify/rename entries under the source path while cp runs; victim runs cp with more read privilege than attacker; destination is attacker-readable.

  1. Create a source directory attacker controls and a destination.
  2. Run cp on a file inside the source while a second process repeatedly swaps that pathname between a regular file and a symlink to a sensitive target.
  3. Observe occasional copies of the symlink target’s contents in the destination when the swap lands between the metadata check and the open.

Activity

  1. sylvestre
    added
    U - cp
    good first issueFor newcomers!
    on Jan 3, 2026
  2. sylvestre
    added
    reported-canonical
    on Jan 17, 2026

  3. denendaden commented on Feb 3, 2026

    @denendaden
    denendaden
    on Feb 3, 2026
    Contributor

    I can't seem to replicate this behavior for GNU cp. I am getting, for GNU cp:
    openat(AT_FDCWD, "/tmp/src/file", O_RDONLY)
    and for uutils cp:
    openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC)

  4. julian-klode commented on Feb 4, 2026

    @julian-klode
    julian-klode
    on Feb 4, 2026
    Contributor

    Not sure what you are looking at but the file is opened multiple times in GNU CP:

    newfstatat(AT_FDCWD, "/tmp/src/file", {st_mode=S_IFREG|0664, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_NOFOLLOW) = 4
fstat(4, {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
openat(3, "src/file", O_WRONLY|O_CREAT|O_EXCL, 0664) = 5
ioctl(5, BTRFS_IOC_CLONE or FICLONE, 4) = -1 EOPNOTSUPP (Operation not supported)
fstat(5, {st_mode=S_IFREG|0664, st_size=0, ...}) = 0

    (sorry target src/file is a bit ... weird)

    First stat file, then open it, then stat open file, then it tries to copy it. Presumably it compares the stat of the NOFOLLOW newfstatat with the opened file.

    For comparison, uutils opens the source file 4 times, never with NOFOLOW.

    openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC) = 4
openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC) = 4
openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC) = 4
openat(AT_FDCWD, "/tmp/src/file", O_RDONLY|O_CLOEXEC) = 6

  5. denendaden commented on Feb 4, 2026

    @denendaden
    denendaden
    on Feb 4, 2026
    Contributor

    This is what I am seeing when I run strace cp /tmp/src/file /tmp/dest:

    newfstatat(AT_FDCWD, "/tmp/src/file", {st_mode=S_IFREG|0644, st_size=0, ...}, 0) = 0
openat(AT_FDCWD, "/tmp/src/file", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
openat(AT_FDCWD, "/tmp/dest", O_WRONLY|O_CREAT|O_EXCL, 0644) = 4
ioctl(4, BTRFS_IOC_CLONE or FICLONE, 3) = -1 EOPNOTSUPP (Operation not supported)
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0

    I've tried building GNU cp from source as well as copying different types of files to/from different locations. I'm not sure why it doesn't appear to be using NOFOLLOW on my system.

  6. mattsu2020
    added a commit that references this issue on Apr 25, 2026

    fix(cp): open source files with O_NOFOLLOW to prevent TOCTOU symlink …

    d370d58
  7. sylvestre
    added 8 commits that reference this issue on May 3, 2026

    cp: open source and dest with O_NOFOLLOW in no-dereference mode (uuti…

    8bc7002

    cp: open source and dest with O_NOFOLLOW in no-dereference mode (uuti…

    5e8dcc2

    cp: open source and dest with O_NOFOLLOW in no-dereference mode (uuti…

    acadaa0

    uucore/mv: fd-based xattr copy for cross-device moves (uutils#10014)

    164e9b5
  8. RenjiSann
    added a commit that references this issue on May 6, 2026

    cp: open source and dest with O_NOFOLLOW in no-dereference mode (#10017)

    ef5d752
  9. sylvestre
    closed this as completedon May 6, 2026
  10. nonontb
    added a commit that references this issue on May 28, 2026

    cp: open source and dest with O_NOFOLLOW in no-dereference mode (uuti…

    53a03a0
  11. sylvestre
    added a commit that references this issue on Jul 4, 2026

    uucore/mv: fd-based xattr copy for cross-device moves (uutils#10014)

    01b16ae
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    U - cpgood first issueFor newcomers!reported-canonical

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions