Listen to this Post
When no system-installed liblz4-java library is found on the host system, the net.jpountz.util.Native.load() method extracts the bundled native library directly into the java.io.tmpdir directory and loads it into memory using System.load.
The core flaw stems from how temporary files are handled during this native library extraction process.
Specifically, only a lock file with a .lck extension is created safely using File.createTempFile, which ensures a random name and exclusive creation.
However, the actual library file path is derived by simply stripping the .lck suffix from the lock file’s absolute path.
Nothing reserves or exclusively creates this target library file before it is opened by the application.
When new FileOutputStream(tempLib) is subsequently invoked, it opens the target file with O_CREAT and O_TRUNC flags, and it eagerly follows symbolic links.
In a shared, world-writable temporary directory, an unprivileged local attacker can monitor for the creation of the .lck file.
Upon spotting it, the attacker can race to create the corresponding native library file before the victim process opens it.
If the attacker wins this race condition, they successfully take ownership of the target library file.
The victim process then unwittingly writes its compiled library contents into the attacker-controlled file.
Before the victim calls System.load, the attacker has a second window to overwrite the contents once again with malicious code.
The exploitation vector and ultimate impact heavily depend on the host operating system configurations and kernel security settings.
On Linux systems where fs.protected_regular is explicitly set to 0, the attacker can pre-create a world-writable file, causing their arbitrary code to be loaded directly into the victim’s Java Virtual Machine.
If fs.protected_regular is set to 1 or higher, which is the default on many modern systemd-based Linux distributions, the victim’s attempt to open the pre-created file fails securely.
Consequently, the library fails to load and gracefully falls back to pure Java implementations, limiting the realistic impact to a denial of service.
Similarly, symlink-based attacks are effectively blocked when fs.protected_symlinks is enabled on the host system.
However, insecure temporary directories lacking the sticky bit, or directories shared across multiple users inside containerized environments, remain fully exploitable regardless of host kernel protections.
This insecure behaviour was originally introduced upstream in commit c3ddae5 within lz4-java version 1.7.0.
DailyCVE Form:
Platform: Yawkat lz4 java
Version: 1.7.0 to 1.11.3
Vulnerability: TOCTOU race condition
Severity: High security risk
date: October 2026
Prediction: Patched version 1.11.4
What Undercode Say:
Monitor temporary directory for lock file creation watch -n 0.1 ls -la /tmp/liblz4-java-
tempLibLock = File.createTempFile("liblz4-java-", "." + os().libExtension + ".lck");
tempLib = new File(tempLibLock.getAbsolutePath().replaceFirst(".lck$", ""));
try (FileOutputStream out = new FileOutputStream(tempLib)) {
// Write native library payload
}
System.load(tempLib.getAbsolutePath());
Exploit: (Educational Purposes!)
An unprivileged local attacker sharing a world-writable temporary directory (/tmp) with a victim running a vulnerable java application can script a background monitor to watch for `liblz4-java-.lck` temporary files. As soon as the `.lck` file appears, the exploit script immediately creates a regular file with the expected library name (omitting the `.lck` extension) before the victim’s `FileOutputStream` opens it. If successful, the attacker overwrites the payload with malicious JNI shared object code, resulting in arbitrary code execution inside the victim JVM process upon System.load().
Protection: from this CVE
Upgrade the `lz4-java` package to version 1.11.4 or higher where the vulnerability is fully resolved. The updated version extracts the native library directly into a file created via `File.createTempFile` with exclusive creation and random naming, removing the insecure `.lck` lock file mechanism entirely. For older versions, configure `java.io.tmpdir` to point to a secure directory writable solely by the application execution user, or ensure `liblz4-java` is installed directly on the java.library.path.
Impact:
A local user with write access to the shared temporary directory can achieve arbitrary native code execution under the security context of the victim process, potentially leading to local privilege escalation or unauthorized access to sensitive application data, provided host system settings permit regular file manipulation and the race condition is won.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
