Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

QFinch assessment

glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDGCACHEHOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). ---

Potential impact

Vulnerability type: Insecure Deserialization (CWE-502) Who is impacted: Any system where Glances is run with version checking enabled (the default) in a shared environment where a less-privileged process can write to the Glances user's XDG cache directory, or in any containerised deployment using shared volumes. Impact: - Confidentiality: Full — the attacker gains code execution in the context of the Glances process and can read any data accessible to that user. - Integrity: Full — arbitrary commands can modify files, install persistence mechanisms, or alter system state. - Availability: Full — the Glances process and, if running as root, the system can be disrupted. On many deployments Glances is run as root (required to access hardware performance counters without specific capabilities), meaning successful exploitation yields full root code execution without any further privilege escalation step. ---

Technical context

Affected file: glances/outdated.py, method Outdated.loadcache(), line 121 Direct URL (commit 04579778e733d705898a169e049dc84772c852da): - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/outdated.pyL121 self.cachefile is constructed from the XDG cache directory path at Outdated.init(): On a default Linux installation this resolves to /home/john/.cache/glances/glances-version.db (or /root/.cache/glances/… when Glances runs as root). Python's pickle module is an execution-capable serialisation format: any class that implements reduce can embed an arbitrary callable and argument tuple that Python will invoke unconditionally at pickle.load() time. There is no safe subset of pickle; the only safe mitigation is to not use it for untrusted data. The code was verified on x8664 Linux, Python 3.13, Glances 4.5.5dev1 (commit 04579778e733d705898a169e049dc84772c852da). A malicious pickle crafted with os.system() via reduce executed the injected shell command successfully before the surrounding Python code raised a TypeError. ---