Insecure temporary file handling in Buzz model_loader.py
Buzz's model_loader.py uses the deprecated tempfile.mktemp() function insecurely, creating a window where an attacker could replace model files before they are opened, potentially enabling code execution and data leaks.
What happened
The Buzz model_loader.py uses the unsafe deprecated function tempfile.mktemp() in multiple locations.
Between the time mktemp() generates a temporary file path and when the application attempts to create a file at that path, another process could create a file with the same name, allowing an attacker to interfere with the file before it is opened.
Reported impact
An attacker could replace the model with a malicious URL model, potentially leading to code execution and data leaks.
Availability is affected by this vulnerability.
Index analysis
Functions that create temporary file names such as tempfile.mktemp() are fundamentally insecure because they do not ensure exclusive access to a file with the temporary name they return.
The file name is guaranteed to be unique on creation but the file must be opened in a separate operation, with no guarantee that the creation and open operations will happen atomically.
Governance controls
The vulnerability can be fixed by using mkstemp() instead of tempfile.mktemp().
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.