[Secure-testing-team] Bug#700608: pigz creates temp files with too wide permissions

[Michael Tokarev]

Package: pigz
Version: 2.2.4-1
Severity: serious
Tags: security


When asked to compress a file with restricted permissions (like
mode 0600), the .gz file pigz creates while doing this has
usual mode derived from umask (like 0644).  If the file is
large enough (and why we would use pigz instead of gzip for
small files), this results in the original content being
readable for everyone until the compression finishes.

Here's the deal:

$ fallocate -l 1G foo
$ chmod 0600 foo
$ pigz foo &
$ ls -l foo foo.gz 
-rw------- 1 mjt mjt 1073741824 Фев 15 12:27 foo
-rw-rw-r-- 1 mjt mjt     502516 Фев 15 12:27 foo.gz

When it finishes, it correctly applies original file permissions
to the newly created file, but it is already waaay too late.

Other one-file archivers (gzip, xz, bzip2, ...) usually create
the temp file with very strict permissions first, and change it
to the right perms only when done, so only the current user can
read it.

It looks like this bug deserves a CVE#.

Thanks,

/mjt