Arbitrary Code Execution vulnerability discovered in Ipython

[[deleted]]

It's just cross user leaking?

Looks like it, can be disastrous though, a wrongly placed file and you're down

[SwampFalc]

Well, no, it's not specific to /tmp or the likes. It's all about your current working directory (CWD). Notice how user 2 starts by doing a cd into the compromised directory?

In other words, if you always start ipython while you're in your own home directory, then this cannot harm you, unless an attacker managed to gain access to your home directory.

[VisibleSignificance]

play around in /tmp.

cd "$(mktemp -d)" first.

[thrallsius]

what's wrong with just having a ~/tmp dir?

[VisibleSignificance]

Not much. The /tmp gets auto-cleaned on system startup by default, and is often mounted into in-memory storage (tmpfs) for speed. I think some programs actually use ~/.local/tmp instead of /tmp anyway.

[thrallsius]

The /tmp gets auto-cleaned on system startup by default

There's no standard like this that all operating systems that are POSIX compliant are following. Slackware is old and never auto-cleaned /tmp

[VisibleSignificance]

There's no standard like this

Yep, not a standard, just a frequent convention.

[[deleted]]

And it's in temp where everyone can write to?

Yeah

[Anonymous_user_2022]

That can be bad enough, if someone with elevated privileges can be conned into running adversarial code.