Lighttpd

security: stat cache very large race condition if caching when follow_symlink disabled

stat_cache.c documents that there is a race condition between stat()/lstat() and open(). This race condition becomes a very large race condition with the "simple" stat cache engine (enabled by default), which caches for one second.

While disabling caching when follow_symlink is disabled will be a performance hit, keeping caching enabled when follow_symlink is disabled is very insecure programming. Doing so creates a huge, easily exploitable race condition. The race condition is so large that it can be exploited with 100% success and without any failures showing up in the error logs.

The following patch disables using stat_cache cache hits when follow_symlink is disabled. One of the lines is for the "simple" stat_cache engine, and the other is for the FAM stat_cache.

diff --git a/src/stat_cache.c b/src/stat_cache.c
index fa9b7cb..7691902 100644
--- a/src/stat_cache.c
+++ b/src/stat_cache.c
@@ -422,7 +422,7 @@ handler_t stat_cache_get_entry(server *srv, connection *con, buffer *name, stat_

                if (buffer_is_equal(name, sce->name)) {
                        if (srv->srvconf.stat_cache_engine == STAT_CACHE_ENGINE_SIMPLE) {
-                               if (sce->stat_ts == srv->cur_ts) {
+                               if (sce->stat_ts == srv->cur_ts && con->conf.follow_symlink) {
                                        *ret_sce = sce;
                                        return HANDLER_GO_ON;
                                }
@@ -463,7 +463,7 @@ handler_t stat_cache_get_entry(server *srv, connection *con, buffer *name, stat_
                        /* check whether we got a collision */
                        if (buffer_is_equal(sc->dir_name, fam_dir->name)) {
                                /* test whether a found file cache entry is still ok */
-                               if ((NULL != sce) && (fam_dir->version == sce->dir_version)) {
+                               if ((NULL != sce) && (fam_dir->version == sce->dir_version) && con->conf.follow_symlink) {
                                        /* the stat()-cache entry is still ok */

                                        *ret_sce = sce;

Aside: leaving caching enabled when using FAM stat_cache engine and follow_symlink is disabled would not be as bad as doing so with "simple" stat_cache engine. The FAM stat_cache engine race condition is only as large as until the next set of FAM events are read and processed, whereas the "simple" stat_cache engine race condition is up to one second long. NOTE: as mentioned before, these stat_cache caching race conditions are both in addition to the race condition between stat()/lstat() and open(), which is not addressed by the above patch.

See also https://redmine.lighttpd.net/issues/2551 "mod_magnet lighty.stat is_symlink" where the symlink race condition is touched upon.