CVE-2026-41051: TOCTOU in csync2

The core of this vulnerability lies in the TOCTOU race condition. csync2 creates temporary files during its synchronization operations. If the program checks for the existence or attributes of a file, but then uses that file before the check's result is finalized, an attacker can modify the file between the check and the use. This could involve replacing a legitimate file with a malicious one, or altering the contents of a file to gain unauthorized access or execute arbitrary code. The potential impact is significant, as an attacker could compromise the integrity of synchronized data and potentially gain control over the system running csync2. The blast radius depends on the scope of the synchronization process; if csync2 is used to synchronize critical system files, the impact could be catastrophic.

1. Reserved2026-04-16
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-41051 is to upgrade to version 2.0+git.1600444747.83b3644-3.1 or later, which addresses the insecure temporary directory handling. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing stricter file permissions on the directories used by csync2 to limit the attacker's ability to modify files. Additionally, review the csync2 configuration to ensure that it is not synchronizing sensitive files or directories unnecessarily. While a direct detection signature is unlikely, monitoring file system activity for unexpected modifications during csync2 operations can provide an early warning sign of potential exploitation. After upgrade, confirm the fix by running a test synchronization with a known set of files and verifying that no unauthorized modifications occur.