CVE-2025-9810

A time-of-check to time-of-use (TOCTOU) race condition exists in linenoise's linenoiseHistorySave() function, where the history file is first opened with fopen("w") and subsequently modified with chmod(). This vulnerability allows a local attacker to manipulate a symbolic link between these two operations: first, pointing the symlink to a sensitive file at the time of opening, and then switching it to another file before the permission change. This flaw allows arbitrary file overwrite or unintended permission modifications.

This vulnerability allows a local, unauthenticated attacker to race linenoiseHistorySave() and overwrite arbitrary files with the calling process’s privileges or change permissions on unrelated files, potentially disrupting system integrity and availability. While the confidentiality impact is none, the integrity impact is high and the availability impact is low, yielding a Moderate severity of CVSS 6.8. Downstream tools that embed linenoise, such as redis-cli, are affected when writing history to attacker-controllable locations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.