CWE-277 Insecure Inherited Permissions: Umask and Temp Files

CWE-277, Insecure Inherited Permissions, describes a product that defines a set of insecure permissions that are inherited by objects the program creates.

It is relevant to anything that writes files, directories, or shared objects: services, scripts, installers, and build tools.

How it happens

Default permissions come from somewhere: the process umask, the parent directory, or a template. If the program does not choose the mode itself, whatever that source says becomes the mode of every new object.

MITRE's examples:

• CVE-2005-1841 (Gold): the user's umask is used when creating temp files.
• CVE-2002-1786 (Gold): insecure umask for core dumps, with MITRE noting the open question of whether the umask is preserved or assigned.

# Vulnerable: mode depends entirely on the caller's umask
open("/tmp/report.tmp", "w").write(secret_report)

With a permissive umask, that file is readable by others.

What an attacker gains

MITRE lists confidentiality and integrity impact: reading and modifying application data. Temp files and core dumps often contain exactly what you least want others to see.

How to find it

• Create objects while running under a permissive umask, such as 000, and inspect their modes.
• Review where the code relies on defaults for files that hold sensitive content.
• Check the modes of temp files, caches, and crash dumps on a running system.

umask 000
./myprogram
ls -l /tmp | grep myprogram

How to fix it

Set permissions explicitly at creation time instead of inheriting them. Use the library functions built for temporary files, which create them with a restrictive mode.

import os, tempfile
fd, path = tempfile.mkstemp()      # created with mode 0600
os.write(fd, secret_report)
os.close(fd)

For long lived files, pass an explicit mode to os.open and set a restrictive umask at process start.

Quick check

Sources

• MITRE CWE-277: https://cwe.mitre.org/data/definitions/277.html
• Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-277