Description

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-03T13:06:20.720Z",
  "pubdate": "2026-09-03T13:06:20.720Z",
  "executiveSummary": "LiME (Linux Memory Extractor) through version 1.12.0 is susceptible to an arbitrary file overwrite vulnerability due to insecure file handling practices during memory acquisition.\nThe vulnerability stems from the application's failure to validate the user-supplied disk acquisition output path and the omission of the O_NOFOLLOW flag when opening files.\nAn unprivileged local attacker can leverage this flaw to trick the kernel-mode LiME process into truncating and overwriting sensitive root-owned files.\nSuccessful exploitation requires the attacker to have control over the output directory where the acquisition data is written.\nBy placing a symbolic link at the expected output path that points to a critical system file, an attacker can cause the kernel to redirect the memory dump stream into that target file.\nThis effectively grants a low-privileged user the capability to corrupt or destroy arbitrary files with system-level privileges.\nThe impact includes system instability, potential privilege escalation, and loss of data integrity, posing a significant risk to systems utilizing LiME for incident response or forensic tasks.",
  "technicalDetails": "The vulnerability is located in the file handling logic of LiME versions 1.12.0 and earlier. Specifically, the kernel-mode component fails to perform adequate input validation or security checks on the path parameter provided by the user for the output of the memory acquisition process.\nWhen LiME opens the target path for writing the memory image, it uses standard file opening operations that do not include the O_NOFOLLOW flag. This flag is critical in preventing the operating system from following symbolic links when opening a file. Because this protection is absent, the kernel-mode process will transparently follow any symbolic links encountered during the file open operation, regardless of the target file's ownership or permissions.\nAn attacker can exploit this by preparing a directory that the LiME process will use as an output location. Within this directory, the attacker creates a symbolic link with the name expected by the LiME tool. The attacker points this symbolic link to a sensitive root-owned system file, such as /etc/passwd or /etc/shadow. When the LiME acquisition is initiated, it runs with kernel-level privileges. Upon attempting to open the destination file for the memory dump, the kernel follows the symbolic link provided by the attacker.\nThe LiME tool then proceeds to open the target file for writing and truncates it, as it expects to begin populating the file with the memory acquisition stream. Because the file was opened via a symbolic link, the truncation and subsequent write operations are performed against the attacker-specified file instead of the intended dump file. Consequently, the memory stream overwrites the sensitive system file.\nThe attack flow is as follows: 1) The attacker gains access to a filesystem location where LiME is configured to write. 2) The attacker removes any existing file at the target location and replaces it with a symbolic link pointing to a restricted system file. 3) The attacker triggers the LiME memory acquisition process. 4) The kernel processes the path, resolves the symlink, and opens the target file as root. 5) The sensitive file is truncated and corrupted by the memory stream, leading to denial of service or potential security bypasses.\nThis vulnerability is particularly dangerous because it executes within the kernel context, bypasses standard user-space filesystem permissions, and requires no prior authentication other than local access to the filesystem."
}