CVE-2025-46327: Snowflake Gosnowflake Race Condition Flaw

CVE-2025-46327 Overview

CVE-2025-46327 is a Time-of-Check to Time-of-Use (TOCTOU) race condition in gosnowflake, the Snowflake Golang driver. The flaw affects versions from 1.7.0 up to but not including 1.13.3. When the Easy Logging feature runs on Linux or macOS, the driver reads its logging configuration from a user-provided file. The driver verifies that only the file owner can write to the configuration file, but the check is racy and does not confirm that the owner matches the user running the driver. A local attacker with write access to the file or its parent directory can overwrite the configuration between the check and the read.

Critical Impact
A local attacker can hijack the driver's logging configuration, controlling log level and output location to redirect sensitive log data or influence application behavior.

Affected Products

Snowflake gosnowflake driver versions 1.7.0 through 1.13.2
Applications embedding gosnowflake on Linux hosts using Easy Logging
Applications embedding gosnowflake on macOS hosts using Easy Logging

Discovery Timeline

2025-04-28 - CVE-2025-46327 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46327

Vulnerability Analysis

The vulnerability is classified under [CWE-367]: Time-of-Check Time-of-Use (TOCTOU) Race Condition. The Easy Logging feature accepts a client-provided configuration file that specifies logging level and output path. On Linux and macOS, the driver checks whether the file is writable only by its owner before parsing it. Two flaws exist in this logic. First, the check and subsequent read are not atomic, permitting an attacker to swap the file contents between the two operations. Second, the check never validates that the owner is the same user identity executing the driver, so a file owned by any local account could pass validation.

Root Cause

The root cause lies in the permission validation logic within client_configuration.go. The driver relies on filesystem metadata (owner and mode bits) captured in a separate syscall from the file open and read used to consume the configuration. It also treats "owner-only writable" as sufficient without binding the owner to the effective user identifier (euid) of the running process.

Attack Vector

Exploitation requires local access with write permission to the configuration file or its containing directory. The attacker stages a benign configuration that passes the ownership and permission check, waits for the driver to invoke the check, then replaces the file with an attacker-controlled configuration before the driver reads it. Successful exploitation lets the attacker set arbitrary log verbosity and redirect output to attacker-chosen paths, potentially leaking credentials, query data, or overwriting sensitive files reachable by the driver process.

// Patch excerpt from client_configuration.go
 	"os"
 	"path"
 	"path/filepath"
-	"runtime"
 	"strings"
 )
// Source: https://github.com/snowflakedb/gosnowflake/commit/ba94a4800e23621eff558ef18ce4b96ec5489ff0
// The patch removes the runtime-based branching and tightens ownership
// verification so the check binds to the running user and executes atomically
// with the file open.

Detection Methods for CVE-2025-46327

Indicators of Compromise

Unexpected modification timestamps on the gosnowflake Easy Logging configuration file shortly before driver startup.
Log output written to unusual filesystem locations, such as world-readable directories or paths outside the application's normal log tree.
Sudden shifts in log verbosity (for example, DEBUG or TRACE) not correlated with any operator change.
Presence of symbolic links or hard links in the directory containing the Easy Logging configuration file.

Detection Strategies

Inventory hosts running Go applications and identify those importing github.com/snowflakedb/gosnowflake at versions between 1.7.0 and 1.13.2.
Monitor file integrity on the Easy Logging configuration file and alert on writes performed by any principal other than the application's service account.
Instrument audit rules (auditd on Linux, Endpoint Security framework on macOS) to record open, rename, and chmod calls against the configuration path.

Monitoring Recommendations

Alert on the driver process opening log files in non-standard directories, particularly world-writable paths such as /tmp or /var/tmp.
Track process ancestry for any writes to the Easy Logging configuration file to catch untrusted local users staging attacker configurations.
Correlate configuration file writes with subsequent driver connections to Snowflake to identify race-window exploitation attempts.

How to Mitigate CVE-2025-46327

Immediate Actions Required

Upgrade gosnowflake to version 1.13.3 or later and rebuild all dependent Go applications.
Restrict write permissions on the Easy Logging configuration file and its parent directory to the exact service account running the driver.
Move the configuration file into a directory that is not writable by any other local user, avoiding shared locations such as /tmp.
Review recent log output paths and content for signs of redirection or exposure of sensitive data.

Patch Information

Snowflake fixed the issue in gosnowflake version 1.13.3. See the GitHub Security Advisory GHSA-6jgm-j7h2-2fqg and the upstream commit ba94a48 for the code changes.

Workarounds

Disable the Easy Logging feature and configure logging programmatically inside the host application until the driver can be upgraded.
Store the Easy Logging configuration in a directory owned by the driver's service account with mode 0700, and set the file itself to mode 0600.
Run the application under a dedicated, unprivileged user account so that no other interactive users can reach the configuration path.

bash

# Example hardening of the Easy Logging configuration path on Linux
sudo install -d -o gosnowflake-svc -g gosnowflake-svc -m 0700 /etc/gosnowflake
sudo install -o gosnowflake-svc -g gosnowflake-svc -m 0600 \
    sf_client_config.json /etc/gosnowflake/sf_client_config.json
# Verify no other user can write to the file or its parent directory
ls -ld /etc/gosnowflake /etc/gosnowflake/sf_client_config.json