CVE-2022-48682

What it actually does

TOCTOU race condition in deletefiles allows arbitrary file deletion by replacing a target with a symlink between check and unlink operations.

Why it matters to the business

Local users or compromised processes can cause permanent data loss or disrupt system operations by deleting arbitrary files when fdupes runs.

How an attack unfolds

An attacker with local access creates a symlink to a sensitive target file, then invokes fdupes in a way that triggers the race window during duplicate deletion, causing the symlink target to be removed instead of the intended duplicate.

How to fix it

Upgrade adrianlopezroche/fdupes to the fixed commit 85680897148f1ac33b55418e00334116e419717f (version 2.2.0 or later) on all systems; rebuild packages from source or obtain updated distribution packages.

How to confirm the fix worked

Verify installed fdupes binary or source matches the fixed commit or version 2.2.0+; run fdupes against test directories containing symlinks to confirm only intended duplicates are removed.

Typical attack path

1. Obtain local user or process execution context on the host
2. Identify or create conditions where fdupes will process files in a shared directory
3. Place a symlink pointing to the desired deletion target in the scan path
4. Trigger or wait for fdupes execution to win the TOCTOU window and unlink the symlink destination

How to detect it

Review system logs and file access timestamps around fdupes execution for unexpected deletions of files outside the scanned directories; correlate with user activity or cron jobs invoking fdupes.

What your security team should do

• Upgrade fdupes to the fixed version immediately on all hosts that run it
• Audit scheduled jobs and user scripts that invoke fdupes and restrict execution to trusted directories
• Monitor for new fdupes releases and include the package in routine vulnerability scanning