Tox Dev
Monthly
The Python filelock library (versions 3.22.0 through 4.2.0) can admit two simultaneous lock holders because its SoftFileLock, MarkerSoftFileLock and SoftFileLease classes mishandle stale-marker breaking when the underlying filesystem recycles a freed inode number. A local attacker with write access to the lock directory who wins a narrow race - freeing their own marker after the stale read, while an honest contender creates a live successor on the reused inode whose modification time is not newer than the saved observation - can cause the honest holder's live marker to be deleted, producing a mutual-exclusion failure with integrity impact. Exploitation requires a local, authenticated account on a shared host, a filesystem that reuses inode numbers (ext4 is named in the advisory), and the non-default soft lock classes; attack complexity is high and no public exploit code was identified at time of analysis, and the issue is not in CISA KEV. The vendor-released patch is 4.2.1.
The Python filelock library (versions 3.22.0 through 4.2.0) can admit two simultaneous lock holders because its SoftFileLock, MarkerSoftFileLock and SoftFileLease classes mishandle stale-marker breaking when the underlying filesystem recycles a freed inode number. A local attacker with write access to the lock directory who wins a narrow race - freeing their own marker after the stale read, while an honest contender creates a live successor on the reused inode whose modification time is not newer than the saved observation - can cause the honest holder's live marker to be deleted, producing a mutual-exclusion failure with integrity impact. Exploitation requires a local, authenticated account on a shared host, a filesystem that reuses inode numbers (ext4 is named in the advisory), and the non-default soft lock classes; attack complexity is high and no public exploit code was identified at time of analysis, and the issue is not in CISA KEV. The vendor-released patch is 4.2.1.