CVE-2024-5742
📋 TL;DR
This vulnerability in GNU Nano allows local privilege escalation through insecure temporary file handling. When Nano is killed during editing, it creates an emergency file with user permissions that attackers can exploit via symlink attacks. Users running vulnerable versions of GNU Nano with write access to temporary directories are affected.
💻 Affected Systems
- GNU Nano
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges by exploiting symlink race condition during emergency file creation.
Likely Case
Local user escalates privileges to another user account or gains unauthorized access to sensitive files.
If Mitigated
Attack fails due to proper file permissions, SELinux/apparmor restrictions, or lack of local access.
🎯 Exploit Status
Requires local access and timing to exploit the race condition during emergency file creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GNU Nano 8.0 and later
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-5742
Restart Required: No
Instructions:
1. Update GNU Nano to version 8.0 or later using your distribution's package manager. 2. For Red Hat systems: 'sudo yum update nano' or 'sudo dnf update nano'. 3. For Debian/Ubuntu: 'sudo apt update && sudo apt upgrade nano'. 4. Verify installation with 'nano --version'.
🔧 Temporary Workarounds
Disable emergency file creation
linuxPrevent Nano from creating emergency files when killed
export NANOEMERGENCYFILE=""
Use secure temporary directory
linuxSet TMPDIR to a secure, user-specific directory
export TMPDIR="$HOME/.tmp"
mkdir -p "$HOME/.tmp"
🧯 If You Can't Patch
- Restrict user access to Nano through sudoers or remove execute permissions
- Implement strict file permissions on /tmp and other world-writable directories
🔍 How to Verify
Check if Vulnerable:
Check Nano version with 'nano --version' and compare to affected versions (before 8.0)Check Version:
nano --version | head -1Verify Fix Applied:
Verify installed version is 8.0 or later with 'nano --version'📡 Detection & Monitoring
Log Indicators:
- Failed privilege escalation attempts
- Unusual symlink creation in /tmp
- Multiple Nano processes killed unexpectedly
Network Indicators:
- None - this is a local attack
SIEM Query:
process.name:"nano" AND file.path:"/tmp/*" AND event.action:"created"🔗 References
- https://access.redhat.com/errata/RHSA-2024:6986
- https://access.redhat.com/errata/RHSA-2024:9430
- https://access.redhat.com/security/cve/CVE-2024-5742
- https://bugzilla.redhat.com/show_bug.cgi?id=2278574
- https://access.redhat.com/security/cve/CVE-2024-5742
- https://bugzilla.redhat.com/show_bug.cgi?id=2278574
- https://lists.debian.org/debian-lts-announce/2024/06/msg00006.html
