CVE-2024-5742: GNU Nano Privilege Escalation Vulnerability

CVE-2024-5742 Overview

A vulnerability was discovered in GNU Nano that allows privilege escalation through an insecure temporary file handling mechanism. When Nano is killed while editing a file, it saves an emergency backup file with the permissions of the running user. This creates a time-of-check time-of-use (TOCTOU) race condition that attackers can exploit through a malicious symlink to escalate privileges on affected systems.

Critical Impact

Local attackers with low privileges can potentially escalate to higher privileges by exploiting the insecure temporary file handling, potentially gaining unauthorized access to sensitive system files or elevated permissions.

Affected Products

• GNU Nano (all versions prior to fix)
• Red Hat Enterprise Linux 6.0
• Red Hat Enterprise Linux 7.0
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0

Discovery Timeline

• 2024-06-12 - CVE-2024-5742 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5742

Vulnerability Analysis

This vulnerability (CWE-59: Improper Link Resolution Before File Access) occurs in GNU Nano's emergency file saving functionality. When Nano receives a termination signal while editing a file, it attempts to save the user's work to an emergency backup file. The vulnerability lies in how Nano handles this emergency file creation process.

The core issue is that Nano creates the emergency file with predictable naming and insufficient validation of the file path. An attacker who can predict when Nano will be killed can create a symbolic link at the expected emergency file location pointing to a sensitive system file. When Nano writes the emergency backup, it follows the symlink and writes to the target file instead, potentially corrupting or overwriting critical system files with attacker-controlled content.

The attack requires local access to the system and relies on winning a race condition between the time Nano checks the file path and when it writes to it. While the attack complexity is high due to the timing requirements and need for user interaction (the victim must be using Nano when it's killed), successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of data accessible to the running user.

Root Cause

The root cause is improper handling of symbolic links during emergency file operations. Nano fails to properly validate that the emergency file path doesn't resolve through a symlink to an unintended target. This allows attackers to redirect file writes to arbitrary locations within the privileges of the user running Nano. The vulnerability is classified as CWE-59, which covers scenarios where software follows symbolic links without proper verification.

Attack Vector

The attack requires local access to the system. An attacker must be able to create files in directories where Nano creates emergency backup files. The attack proceeds as follows:

1. The attacker identifies a target file they wish to modify (such as configuration files or scripts)
2. The attacker creates a symbolic link at the predicted emergency file location pointing to the target file
3. The attacker waits for or causes Nano to be killed while a user is editing
4. When Nano saves the emergency file, it follows the symlink and writes to the attacker-specified target

The attack requires precise timing and prediction of the emergency file location, making exploitation non-trivial but feasible in certain scenarios. The vulnerability requires user interaction (someone must be actively editing in Nano) and local privileges.

Detection Methods for CVE-2024-5742

Indicators of Compromise

• Unexpected symbolic links appearing in directories where Nano creates emergency backup files (typically /tmp or the directory containing the edited file)
• Unusual file modifications to system configuration files or scripts that correlate with Nano termination events
• Suspicious process activity around Nano processes, including signals being sent to nano processes
• Emergency backup files (files with .save extension) pointing to sensitive system locations

Detection Strategies

• Monitor for symlink creation in common Nano emergency file directories using file integrity monitoring tools
• Audit SIGKILL and SIGTERM signals sent to nano processes from non-standard sources
• Implement filesystem auditing to track symlink operations in temporary directories
• Use security tools that detect TOCTOU race condition exploitation attempts

Monitoring Recommendations

• Enable auditd rules to monitor nano process terminations and file operations
• Configure file integrity monitoring on sensitive system files that could be symlink targets
• Monitor for unusual patterns of symlink creation followed by nano process terminations
• Review system logs for unexpected file permission changes or modifications to protected files

How to Mitigate CVE-2024-5742

Immediate Actions Required

• Update GNU Nano to the latest patched version available for your distribution
• Apply vendor security patches from Red Hat or Debian as applicable to your environment
• Review and restrict write permissions in directories where Nano creates emergency files
• Consider using alternative text editors for sensitive editing tasks until patches are applied

Patch Information

Security patches are available from major Linux distributions. Red Hat has released security advisories RHSA-2024:6986 and RHSA-2024:9430 addressing this vulnerability. Debian has also released updates as documented in their LTS Announcement. Administrators should apply the appropriate patches for their distribution using standard package management tools.

For detailed CVE information and tracking, refer to the Red Hat CVE Details or Red Hat Bugzilla Report #2278574.

Workarounds

• Restrict the use of Nano in shared or multi-user environments until patches are applied
• Configure the system to use sticky bit on /tmp directories to prevent symlink attacks
• Use filesystem protections like protected_symlinks sysctl option (fs.protected_symlinks=1)
• Implement mandatory access control policies (SELinux/AppArmor) to restrict Nano's file operations

# Enable symlink protection (recommended mitigation)
echo "fs.protected_symlinks = 1" >> /etc/sysctl.conf
sysctl -p

# Verify the setting is active
sysctl fs.protected_symlinks