CVE-2021-24032: 
CBL Mariner vulnerability analysis and mitigation

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. This vulnerability is tracked as CVE-2021-24032, affecting the Zstandard compression utility (Debian Security, NVD).

The vulnerability stems from a race condition in the file permission handling where output files were initially created with default permissions before being chmod'd to more restrictive permissions. During this brief window between file creation and permission modification, the files could be accessible to unintended parties. The vulnerability has a CVSS v3.1 base score of 4.7 (Medium), with attack vector being Local, attack complexity High, and requiring Low privileges (Ubuntu Security).

The vulnerability could allow an attacker to access sensitive compressed files during the brief window when they are created with default permissions before being restricted. This could lead to unauthorized access to confidential data that was intended to be protected by restrictive file permissions (Debian Bug).

The vulnerability can be exploited locally by monitoring file creation events (for example, using inotify) and accessing the file during the brief window when it has default permissions. The attack requires precise timing but is practically exploitable (GitHub Issue).

The issue was fixed in Zstandard version 1.4.9 by modifying the file creation process to set restrictive permissions at the time of file creation, rather than afterwards. The fix involves using proper file permission settings during the initial open() system call or adjusting the process umask before file creation (GitHub Issue).