What this actually is.
Technical background, root cause, and affected surface.
A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3.7
- Status
- Published
- CWE
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
libatalk/adouble/ad_flush.c: ad_flush() checks file ownership then writes with root privilege without holding a lock between check and write
Root cause: Non-atomic check-then-use pattern in ad_flush() without holding a file lock across the privilege-check and write operations
When does this fire?
All conditions must be true for the exploit to succeed.
Local attacker with filesystem access races to replace a file with a symlink between the ad_flush() permission check and write operation
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Limited file modification via symlink substitution during the TOCTOU window, exploiting root privilege of ad_flush()
C:N · I:L · A:N
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which uses O_NOFOLLOW and atomic file operations in ad_flush() to eliminate the TOCTOU window.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.