bug#80572: [BUG] Privilege escalation via cp trying to replace file contents using root privileges

On 2026-03-08 01:04, Collin Funk wrote:

> The behavior you see is surprising to me.
Yes, I'm not understanding it either. Just to double check, he writes 
that /tmp and /usr/bin are the same file system. In that case, 'cp -f 
/usr/bin/nmap /tmp/nmap' should do something like this:

   openat(AT_FDCWD, "/tmp/nmap", O_RDONLY|O_PATH|O_DIRECTORY) = -1 
ENOENT (No such file or directory)
   newfstatat(AT_FDCWD, "/usr/bin/nmap", {st_mode=S_IFREG|0755, 
st_size=138120, ...}, 0) = 0
   openat(AT_FDCWD, "/usr/bin/nmap", O_RDONLY) = 3
   fstat(3, {st_mode=S_IFREG|0755, st_size=138120, ...}) = 0
   openat(AT_FDCWD, "/tmp/nmap", O_WRONLY|O_CREAT|O_EXCL, 0755) = 4
   ioctl(4, BTRFS_IOC_CLONE or FICLONE, 3) = -1 EOPNOTSUPP (Operation 
not supported)
   fstat(4, {st_mode=S_IFREG|0755, st_size=0, ...}) = 0
   lseek(3, 0, SEEK_DATA)                  = 0
   lseek(3, 0, SEEK_HOLE)                  = 138120
   lseek(3, 0, SEEK_SET)                   = 0
   copy_file_range(3, NULL, 4, NULL, 2146435072, 0) = 138120
   copy_file_range(3, NULL, 4, NULL, 2146435072, 0) = 0
   close(4)                                = 0
   close(3)                                = 0

and 'mv -f /tmp/nmap /usr/bin/nmap' should do something like this:

   renameat2(AT_FDCWD, "/tmp/nmap", AT_FDCWD, "/usr/bin/nmap", 
RENAME_NOREPLACE) = -1 EEXIST (File exists)
   openat(AT_FDCWD, "/usr/bin/nmap", O_RDONLY|O_PATH|O_DIRECTORY) = -1 
ENOTDIR (Not a directory)
   newfstatat(AT_FDCWD, "/tmp/nmap", {st_mode=S_IFREG|0755, 
st_size=138120, ...}, AT_SYMLINK_NOFOLLOW) = 0
   newfstatat(AT_FDCWD, "/usr/bin/nmap", {st_mode=S_IFREG|0755, 
st_size=138120, ...}, AT_SYMLINK_NOFOLLOW) = 0
   renameat(AT_FDCWD, "/tmp/nmap", AT_FDCWD, "/usr/bin/nmap") = 0

He can use 'strace' to verify this, and if 'strace' reports anything 
different we can take it from there.

I am assuming bleeding-edge coreutils; if he's using older coreutils 
perhaps the older version has been fixed and he should upgrade.