Description

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-06T15:17:27.613Z",
  "pubdate": "2026-08-06T15:17:27.613Z",
  "executiveSummary": "LightFTP through 2.4 contains multiple data race vulnerabilities residing within ftpserv.c. The flaw allows unauthenticated, anonymous attackers to trigger undefined behavior by issuing a sequence of FTP commands, specifically a LIST command followed immediately by an ABOR command. The primary impact of this vulnerability is potential denial of service due to resource exhaustion, file descriptor corruption, and unintended manipulation of unrelated system resources. The affected product is LightFTP versions up to and including 2.4. Risk implications include service instability, application crashes, and potential unintended access or modification of system resources due to stale file descriptor reuse by the operating system. Exploitation requires network access to the FTP service, but no prior authentication or specific privileges are necessary, as the protocol permits anonymous command issuance. The attack relies on precise timing and concurrency manipulation to exploit the race condition between the control thread and worker threads.",
  "technicalDetails": "The root cause of the vulnerability is a concurrency flaw and lack of proper synchronization in ftpserv.c. Specifically, the control thread handles incoming FTP commands and is responsible for closing the data_socket and file_fd descriptors when an abort operation is requested. Concurrently, worker threads operate on these same fields during the execution of the worker_thread_cleanup function. When an unauthenticated attacker issues a LIST command to initiate a directory listing over a data connection, and then rapidly issues an ABOR command, the control thread proceeds to close the associated file and socket descriptors. However, worker threads may still be actively referencing or operating on these descriptors. This race condition leads to a scenario where stale file descriptors are left open to being reassigned by the operating system to entirely unrelated resources. Subsequently, the asynchronous worker threads utilize these stale descriptors on the newly assigned, unrelated resources, resulting in undefined behavior, memory corruption vectors, or application instability. The vulnerable component is the multi-threaded request handling and cleanup mechanism implemented in ftpserv.c of LightFTP. Affected versions include all releases up to and including version 2.4. The attack vector is network-based, exploiting the standard FTP protocol command set. Attackers do not require authentication or elevated privileges, as the vulnerability can be triggered via anonymous access. The payload behavior involves rapidly cycling through command execution to win the race condition window between descriptor closure in the control thread and cleanup routines in the worker threads. Post-exploitation impact is primarily concentrated on denial of service, causing the FTP service to crash, hang, or misbehave by interacting with unintended system files or sockets due to descriptor reuse."
}