Description

A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory.  This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-11-05T18:17:00.967Z",
  "pubdate": "2026-11-05T18:17:00.967Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists within the log-cleanup function of the SafeNet Authentication Client (SAC) SACSrv service.\nThis vulnerability allows an authenticated, non-privileged local attacker to manipulate file system operations, resulting in the unauthorized deletion of arbitrary files with the privileges of the SACSrv service (typically SYSTEM).\nThe flaw affects SafeNet Authentication Client releases up to and including version 10.9 R3 GA (build 10.9.7449).\nBy exploiting the race window between the security check of a file path and the subsequent deletion operation, an attacker can redirect the service to delete sensitive system or application files that exist outside of the intended log directory.\nThis represents a significant local security risk, as successful exploitation results in a loss of system integrity or potential denial-of-service by removing critical operating system or product components.",
  "technicalDetails": "The vulnerability resides in the SACSrv service, which performs automated maintenance tasks, specifically the cleanup of log files. The root cause is a TOCTOU race condition within the logic responsible for identifying and purging these files.\nThe flaw occurs because the service performs a validation check on the target directory or file path before executing the actual file system deletion command. The application fails to maintain atomicity between the validation (the 'check') and the deletion (the 'use').\nAn authenticated local attacker can leverage this window of time to modify the file system environment, typically by utilizing symbolic links, junction points, or mount points. The attack flow proceeds as follows: First, the attacker monitors the SACSrv service to identify when the log-cleanup function is triggered. Second, just after the service performs its validation check on a legitimate log file path but before the actual deletion API call is invoked, the attacker replaces the target path or an intervening directory component with a symbolic link or junction pointing to a sensitive system file.\nBecause the SACSrv service executes with elevated privileges (SYSTEM), the underlying file system API call ignores the attacker's low-privilege context and proceeds to delete the file targeted by the symbolic link. This allows an attacker to bypass standard file system access control lists (ACLs) that would otherwise prevent a non-administrator from deleting sensitive system files.\nThe vulnerability is restricted to the local machine, requiring the attacker to have already established a session as an authenticated user. It does not require remote network access, but its impact is severe due to the potential for arbitrary file deletion, which can lead to system instability, the destruction of security logs to obfuscate other malicious activities, or the removal of critical binaries, effectively causing a permanent denial-of-service on the affected system.\nThe affected component is the SACSrv background service present in all versions of the SafeNet Authentication Client up to and including 10.9 R3 GA (build 10.9.7449). Proper remediation requires ensuring that file system operations are performed using secure, race-condition-resistant handles, such as those provided by opening a file descriptor and performing operations on that descriptor rather than relying on path-based operations that are susceptible to replacement attacks."
}