There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar objcopy strip ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users) an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

🗓️ 02 Apr 2021 07:00:00Reported by MicrosoftType

Race window in GNU binutils 2.35 and earlier lets privileged users own files via a symlink.

Reporter	Title	Published	Views	Family All 90
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software	6 Aug 202110:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX Certified Container is affected by multiple vulnerabilities in Red Hat Universal Base Image version 8.4-206.1626828523 and Binutils version 2.30-93	14 Mar 202220:12	–	ibm
Tenable Nessus	AlmaLinux 8 : binutils (ALSA-2021:4364)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : binutils (CESA-2021:4364)	11 Nov 202100:00	–	nessus
Tenable Nessus	CentOS 9 : gcc-toolset-13-binutils-2.40-8.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-1964)	4 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1974)	4 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1976)	28 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-2024)	30 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2047)	1 Jul 202100:00	–	nessus