CyberRota Analysis
AI-GeneratedA vulnerability in GLib2 affects the g_file_replace() function when used with G_FILE_CREATE_REPLACE_DESTINATION, allowing a local attacker to exploit a race condition. If the creation of a temporary file fails, the library may unlink the destination and recreate it without proper protections, enabling the attacker to redirect writes to an unintended file. Organizations using GLib2 in environments where local users can write to the destination directory should prioritize addressing this issue to mitigate potential data manipulation risks.
Original NVD Description
A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.