Description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pi-hole pi-hole
>= 6.4.2, < 6.5affected
References
- https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj ↗
- https://github.com/pi-hole/pi-hole/pull/6719 ↗
- https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25 ↗
- https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb ↗
- https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517 ↗
- https://github.com/pi-hole/pi-hole/releases/tag/v6.5 ↗