CVE-2026-112908: filelock: lax claim dir perms let local users break strict lock

`StrictSoftFileLock` and `AsyncStrictSoftFileLock` apply the caller's `mode` to the sentinel (the lock file at `<path>`) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, `<path>.filelock` and `<path>.filelock/claims`, with a bare `mkdir()`. That gives `0o777` filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default ACL (an access control list on a directory that sets the permissions of entries created inside it), through that ACL. A hold consists of two claim names in that directory, which has no sticky bit (a directory flag that lets only a file's owner remove it). When the environment leaves another local user (the other user below) a write bit on the directory, that user can unlink the holder's `0600` claims. Three settings do this: umask `000` in a sticky directory such as `/tmp`, umask `002` with the other user in the directory's group, or a default ACL on the lock's parent that grants the group write (the kernel then ignores the umask). After the unlink, the next contender of the holder's account finds the directory empty and enters. The first holder keeps reporting `is_locked == True` and later releases with no error. Affected versions: filelock >= 3.30.0 and <= 4.2.0 (finding `ANT-2026-AD6SUOON`). ## Severity **CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, 5.3 (Medium).** `AV:L` (local): the other user needs an account on the same host. `AC:H` (high attack complexity): the holder must pass a restrictive `mode` while its umask or the parent's default ACL leaves the other user a write bit on new directories, and a contender of the holder's account must ask for the lock after the claims are gone. With the common umask `022` and no default ACL the directories are `0755`, and the kernel refuses the other user's unlink. `PR:L` (low privileges): an unprivileged account is enough. `UI:N` (no user interaction): the holder's processes act on their own. `C:N` (no confidentiality impact): the `0600` claim files stay unreadable. `I:H` (high integrity impact): two holders then write the data the lock protects, and neither learns of the other. `A:L` (low availability impact): the same write access lets the other user create names in `claims`, and an empty file named `held-v1-<32 zeros>.claim` makes the next `acquire()` raise `SoftFileLockProtocolError` ("malformed claim record") until someone removes it. Classification from the review: security, conditional on a lax umask or a permissive default ACL. The scanner rated it high (CWE-732). ## Scope and preconditions - The holder passes a restrictive `mode` such as `0o600`. Without one, the umask decides the permissions by documented design (the "File permissions and mode" section of `docs/concepts.rst` defines `mode` only for the lock file). Umask `000` with the default mode gives the same two-holder result but is outside this finding. - The holder's environment leaves the other user a write bit on new directories. The scanner measured three ways, with `mode=0o600` and the other user a member of group `team`: | lock's parent directory | holder's umask | `<path>.filelock` and `claims/` | who can unlink the claims | |---|---|---|---| | `1777`, like `/tmp` | `000` | `0777` | any other local user | | `root:team`, `3775` (setgid, so new entries inherit the group, and sticky) | `002` | `2775` | any member of `team` | | `root:team`, `1770`, default ACL `group:team:rwx` (`setfacl -d -m g:team:rwx`) | `077` | `0770` | any member of `team` | | `root:team`, `3775`, no ACL | `022` | `2755` | no one; the second process times out | The default-ACL row is the strongest. A holder with a private umask and `mode=0o600` still gets group-writable claim directories. The lock file in that row is `0600`, because its mode reaches `os.open` and masks the inherited ACL. - A contender that may enter asks for the lock: another process of the holder's account, or root. Nothing needs planting beforehand. The holder creates and owns the whole tree, so the existing-directory branch of `_ensure_protocol_directory` (the subject of GHSA-9c4x-gm8v-wgc4) plays no part. - Directories that an affected release already created keep their mode. A `0777` `<path>.filelock` from an earlier run stays writable by other users after an upgrade, because filelock does not remove these directories. Upgraders should `chmod` or remove existing `<path>.filelock` trees (see Workarounds). - The other lock classes do not have this gap in the same setting. With umask `000` and `mode=0o600`, `FileLock` and `SoftFileLock` create one `0600` file and nothing else, and `SoftReadWriteLock` creates its directories `0700` under any umask. Platform: POSIX permission semantics; demonstrated on Linux. filelock's checks against another local user hold only when no other user can replace the lock's directory or any of its ancestors. That is the case when each ancestor belongs to the lock's user or root and is either not writable by others or sticky. A user who can rename entries in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that. ## Affected code At the scanned commit b831496, the bare `mkdir()` sits in [`_ensure_protocol_directory`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L996-L998). [`StrictSoftFileLock._acquire`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L127-L133) calls it for both levels without a mode. It then passes `self._open_mode()` to the sentinel and, through [`_attempt_doorway`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L179-L181), to both claim files. The doorway (the acquire step that scans existing claims and publishes the caller's own) proceeds when the claim scan is empty. [`_unlink_owner_path_result`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_strict.py#L896-L900) counts a missing claim name as removed on release. ## Introduced The bare `mkdir()` arrived with the claim directories in 650c17c79c54 ("feat(strict): replace shared markers with owner claims", #659, 2026-07-14), first released in 3.30.0. We checked this against the git tags. Every release since 3.30.0 has it. ## Mechanism A process with umask `000` that takes `StrictSoftFileLock("/tmp/<dir>/x.lock", mode=0o600)` leaves this on disk while it holds the lock, every entry owned by the holder: ``` 0600 x.lock 0777 x.lock.filelock 0777 x.lock.filelock/claims 0600 x.lock.filelock/claims/held-v1-<token>.claim 0600 x.lock.filelock/claims/intent-v1-<token>.claim ``` Removing a name needs write permission on the directory, and these directories are not sticky. Another local user who cannot read either claim can therefore unlink both. Renaming `claims/` away inside the `0777` `<path>.filelock` has the same effect. For this lock class the directory permissions decide who can end a hold. The sentinel at `<path>` is permanent and says nothing about who holds. A contender starts its doorway by listing the claim directory and proceeds when it is empty. Once the two names are gone, the next contender publishes its own intent and held claims and enters. The original holder does not notice. `is_locked` is its own counter, and `_release` removes its claims by name through `_unlink_owner_path_result`, which takes `FileNotFoundError` as "already removed". The first process therefore releases with exit status 0. No `force_break()`, lifetime or legacy client takes part. The other user's action is a plain `unlink`. The right to do it comes from filelock's `mkdir`, not from anything the application asked for. In the same setting the other user can neither read nor remove the `0600` sentinel in the sticky parent. With the common umask `022` and no default ACL the directories are `0755`. Other users can then list the claim names, which `mode=0o600` does not suggest either, but cannot remove them, and the second process times out. ## Reproduction The scanner's reproducer for finding `ANT-2026-AD6SUOON`, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The `repro` script drives the files under `repro.d/`. **`repro`** ```python #!/usr/bin/env python3 import os import pwd import shutil import stat import subprocess import sys import tempfile AS_VICTIM = {"user": "victim", "group": "victim", "extra_groups": [], "text": True} AS_ATTACKER = {"user": "attacker", "group": "attacker", "extra_groups": [], "text": True} def start_victim_service(lock_path, umask): command = [sys.executable, "/tmp/repro.d/victim_service.py", lock_path] return subprocess.Popen(command, stdin=subprocess.PIPE, stdout=subprocess.PIPE, umask=umask, **AS_VICTIM) def hold_lock_while_attacker_strikes(label, shared, victim_umask): lock_path = f"{shared}/umask{victim_umask:03o}.lock" claims = f"{lock_path}.filelock/claims" first = start_victim_service(lock_path, victim_umask) assert first.stdout.readline() == "entered\n" claim_files = [f"{claims}/{name}" for name in sorted(os.listdir(claims))] for path in (lock_path, f"{lock_path}.filelock", claims, *claim_files): status = os.lstat(path) owner = pwd.getpwuid(status.st_uid).pw_name print(f"{label}: {stat.S_IMODE(status.st_mode):04o} {owner} {os.path.relpath(path, shared)}") # attack, while the first victim process is inside its critical section attacker = subprocess.run( [sys.executable, "/tmp/repro.d/attacker_remove_claims.py", lock_path], stdout=subprocess.PIPE, check=True, **AS_ATTACKER, ) for line in attacker.stdout.splitlines(): print(f"{label}: attacker: {line}") claims_left = len(os.listdir(claims)) print(f"{label}: claims left: {claims_left}") second = start_victim_service(lock_path, victim_umask) second_says = second.stdout.readline().strip() # the first is told to leave only after the second has answered, so an "entered" means both were inside at once first_says = first.communicate("leave\n")[0].strip() second.communicate("leave\n") print(f"{label}: second process: {second_says}") print(f"{label}: first process, asked afterwards: {first_says}, exit status {first.returncode}") both_inside = second_says == "entered" and first_says == "leaving, is_locked=True" and first.returncode == 0 return claims_left, both_inside # set up: a shared directory like /tmp, sticky and writable by everyone shared = tempfile.mkdtemp(prefix="strict-mode-", dir="/tmp") os.chmod(shared, 0o1777) # the two rounds differ only in the umask the victim's processes run with control_claims_left, control_both_inside = hold_lock_while_attacker_strikes("CONTROL umask 022", shared, 0o022) attack_claims_left, attack_both_inside = hold_lock_while_attacker_strikes("OBSERVED umask 000", shared, 0o000) shutil.rmtree(shared) # check: with mode=0o600, another user must not be able to let a second process in beside the first print(f"CONTROL two holders at once: {control_both_inside}") print(f"OBSERVED two holders at once: {attack_both_inside}") control_excludes = control_claims_left == 2 and not control_both_inside print("BUG" if control_excludes and attack_claims_left == 0 and attack_both_inside else "OK") ``` **`repro.d/attacker_remove_claims.py`** ```python import os import sys claims = f"{sys.argv[1]}.filelock/claims" try: names = sorted(os.listdir(claims)) except PermissionError: print("listing denied") names = [] for name in names: try: os.unlink(f"{claims}/{name}") print(f"unlinked {name}") except PermissionError: print(f"unlink denied {name}") ``` **`repro.d/victim_service.py`** ```python import sys from filelock import StrictSoftFileLock, Timeout lock = StrictSoftFileLock(sys.argv[1], mode=0o600) try: with lock.acquire(timeout=2): print("entered", flush=True) sys.stdin.readline() # stay in the critical section until told to leave print(f"leaving, is_locked={lock.is_locked}", flush=True) except Timeout: print("Timeout", flush=True) ``` ## Attack sequence ```mermaid sequenceDiagram participant H as holder (umask 000, mode=0o600) participant D as x.lock.filelock/claims participant X as other local user participant C as contender (same account as the holder) H->>D: mkdir() both directories: 0777, claims 0600 H->>D: publish intent and held claims, enter X->>D: read claim: EACCES (0600) rect rgb(255, 214, 214) X->>D: unlink both claims (directory is 0777, not sticky) C->>D: acquire(): scan finds no claims, publishes, enters Note over H,C: both inside at once H->>D: release(): claims missing, counted as removed, exit status 0 end Note over H,D: control under umask 022: directories 0755, unlink denied, contender raises Timeout ``` ## Evidence The scanner's reproducer runs the holder's `StrictSoftFileLock(path, mode=0o600)` with `timeout=2` as account `victim` (uid 1000) and the unlink loop as account `attacker` (uid 1001). Both run in a fresh root-owned `1777` directory under `/tmp`, at commit b831496 on Linux 6.1 (overlayfs), CPython 3.14.8. Two rounds differ only in the umask the holder's processes start with. Under `CONTROL umask 022`, the directories are `0755`, the kernel denies the unlinks, both claims remain, and the second process prints `Timeout`. Under `OBSERVED umask 000`, every file is still `0600` but `<path>.filelock` and `claims/` are `0777`. The other account prints `unlinked held-v1-<token>.claim` and `unlinked intent-v1-<token>.claim` followed by `claims left: 0`. The second process prints `entered`. The first process prints `leaving, is_locked=True, exit status 0` when asked afterwards. The verdict lines read `CONTROL two holders at once: False` and `OBSERVED two holders at once: True`; the overall verdict is `BUG`. The scanner ran the umask `002` and default-ACL rows of the table by hand at the same commit with the same result. Our review ran the reproducer against the 4.2.0 release image and the scanned commit (`BUG` on both) and against the head of #839 (`OK`). The review's regression test covers the owner, group-read and group-write modes. ## Impact Another local user who gets a write bit on the claim directories ends a live `StrictSoftFileLock` hold. A second honest process of the holder's account then enters the critical section beside the first. Neither holder receives any signal. This is the overlap the strict lock's fail-closed contract exists to rule out. The same write access lets the other user deny the lock by planting a malformed claim name. This does not disclose the claims' contents (the `0600` claim files stay unreadable), and it does not affect holders whose directories came out `0755` or tighter. ## Workarounds Run processes that take strict locks with umask `022` or `077`. Do not put a default ACL that grants other accounts write on the lock's parent directory; where you intend group sharing, trust every member of that group with the lock. Keep strict locks in a directory other users cannot write. For paths already in use, `chmod 700` (or remove, while no process holds the lock) every existing `<path>.filelock` tree. Its mode comes from creation time and nothing changes it afterwards: `find <dir> -maxdepth 1 -type d -name '*.filelock' -exec chmod -R go-w {} +`. ## Patched version 4.2.1. Fix: https://github.com/tox-dev/filelock/pull/839 ## Credits Reported by Anthropic's OSS Scanner (automated analysis), 15 October 2026; reviewed by the maintainers. - 2026-10-15 23:08 UTC: report received (finding `ANT-2026-AD6SUOON`, scanned commit b831496b0273) - 2026-10-16 01:31 UTC: fix PR #839 opened - 2026-10-16 05:39 UTC: draft advisory created (first as part of GHSA-9c4x-gm8v-wgc4, then split into this advisory)

On a shared GPU training server, a service account runs a pipeline with umask 002 that uses StrictSoftFileLock(mode=0o600) to serialize writes to a model checkpoint cache in a group-writable directory. A malicious or compromised teammate in the same group lists the claims directory and unlinks the two claim files while the lock is held. A second pipeline process from the service account then acquires the lock and writes the same checkpoint concurrently, silently corrupting or mixing model artifacts. Neither process is told, and the original holder releases cleanly. The attacker could instead drop an empty malformed claim file so later jobs fail to acquire the lock.