Listen to this Post
The CVE-2024-29037 vulnerability in virtualenv exploits a TOCTOU (Time-of-Check-Time-of-Use) race condition in directory creation operations. When virtualenv sets up app_data and lock file directories, it uses non-atomic check-then-act sequences: first verifying if a directory exists, then creating it if missing. This creates a narrow time window where a local attacker can intercept the process. By repeatedly checking and manipulating filesystem links, the attacker can replace the target directory with a symbolic link to a controlled location. This redirects virtualenv’s caching and locking mechanisms to attacker-owned paths. Specifically, during directory creation in shared temporary spaces or when VIRTUALENV_OVERRIDE_APP_DATA is set, the attacker leverages symlink swaps after the existence check but before actual creation. This allows poisoning of wheel caches with malicious packages, unauthorized reading of cached metadata, manipulation of lock files to induce concurrent access errors, or causing denial of service via lock starvation. The flaw stems from improper synchronization in concurrent execution, classified under CWE-362 and CWE-59, affecting all versions up to 20.36.1. The fix replaces vulnerable code with atomic os.makedirs(…, exist_ok=True) calls, eliminating the race condition by ensuring directory creation is indivisible.
Platform: virtualenv
Version: <=20.36.1
Vulnerability: TOCTOU symlink attack
Severity: Critical
Date: January 2024
Prediction: Patched 20.36.2
What Undercode Say:
Analytics:
virtualenv --version export VIRTUALENV_OVERRIDE_APP_DATA=/tmp/attacker_controlled python -m virtualenv /tmp/test_env ls -la $VIRTUALENV_OVERRIDE_APP_DATA while true; do ln -sf /tmp/attacker_dir /tmp/virtualenv_target; done
import os
import threading
def race_condition():
if not os.path.exists('target_dir'):
os.makedirs('target_dir')
How Exploit:
Local attacker monitors shared directories for virtualenv operations, rapidly swapping target directories with symlinks to controlled paths after checks but before creation, enabling cache poisoning or lock manipulation.
Protection from this CVE:
Upgrade to virtualenv 20.36.2+, restrict VIRTUALENV_OVERRIDE_APP_DATA to user-owned directories with 0700 permissions, avoid shared temporary directories.
Impact:
Cache poisoning, information disclosure, lock bypass, denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
