VYPR
← All advisories
High severity7.1GHSA Advisory· Published Jan 28, 2025· Updated Apr 15, 2026

CVE-2024-45339

CVE-2024-45339

Description

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-45339 is a symlink race condition in glog where an unprivileged attacker can pre-create a symlink to a sensitive file, allowing log writes to overwrite arbitrary files; fixed by exiting on existing log files.

CVE-2024-45339 is a symlink race vulnerability in the glog logging library. When logs are written to a widely-writable directory (the default behavior), an unprivileged attacker can predict the exact file path of a privileged process's log file and pre-create a symbolic link to a sensitive file in its place. The vulnerability arises because glog previously used os.Create without the O_EXCL flag, allowing the privileged process to follow the planted symlink and overwrite the target file with log data [1][3].

The attack surface relies on the predictability of glog's log file naming scheme, which includes the program name, host, username, tag, date, time, and PID—all of which can be anticipated by an attacker [3]. Because the log directory (e.g., /tmp) is often world-writable, an unprivileged user can create a symlink that points to a critical system file like /etc/shadow. When the privileged process (e.g., a root cron job) runs and opens the log file, it inadvertently follows the symlink and overwrites the target [2][3].

The impact is severe: an attacker with low privileges can cause a high-integrity process to corrupt or destroy sensitive files, leading to denial of service or privilege escalation. The overwrite is arbitrary, limited only by the permissions of the logging process [1][3].

The fix, introduced in pull request #74 and merged in commit b874165, changes glog to open log files with the O_EXCL flag (via os.OpenFile). If the log file already exists—whether as a symlink or a regular file—the open call fails, and glog exits with status code 2, preventing the attack [3][4]. Users are advised to update their glog dependency to the patched version.

References
  1. NVD - CVE-2024-45339
  2. Insecure Temporary File | OWASP Foundation
  3. Fail if log file already exists by chressie · Pull Request #74 · golang/glog
  4. Fail if log file already exists by chressie · Pull Request #74 · golang/glog

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/golang/glogGo
< 1.2.41.2.4

Affected products

449

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.