# Temp file and rename race redirect

Privileged writes to user-influenced paths via temp-file-then-rename or path concatenation that can be swapped

_Area: Memory corruption and native code. Seen in 2 disclosed reports; 2 confirmed bounties: $6,000 and $30,500; latest 2025-07-29. Updated 2026-11-08._

## How it works
A privileged component writes to a path it does not fully control. Two assumptions break. First, the path is treated as stable between the moment it is checked and the moment it is used: a temp file is created, then `rename()`d into place, but `rename()` resolves the old and new paths separately, so another process can swap a directory or symlink in between and redirect the write [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md). Second, the path is treated as contained: a filename is concatenated onto a base folder without sanitizing traversal sequences, so `..\..\` escapes the intended directory [E2](https://bugbountylibrary.com/r/h1%3A2995025.md). In both cases the writer holds more privilege than the attacker, and the attacker controls where the bytes land.

## Where it shows up
- Environment variables that name an output or debug file path, consumed by a privileged process [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md)
- `createFileAtPath()`-style helpers that internally do temp-write-then-rename [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md)
- Debug/inspector commands that fetch a remote URL or filename into a local path [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Raw string concatenation of a base folder with an attacker-supplied filename [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Security products that whitelist a path but not the inode/handle, leaving rename/move/junction on the parent unmonitored [E3](https://bugbountylibrary.com/r/h1%3A1003007.md)
- Privileged delete or write operations acting on a path that a lower-privileged process can recreate or swap [E3](https://bugbountylibrary.com/r/h1%3A1003007.md)

## How to review
Identify every privileged write/delete whose target path derives from attacker-influenced input (env var, remote message, filename). The invariant: the operation must act on a handle or inode resolved once, not on a path re-resolved at use time, and the final path must be proven to stay inside the intended directory after normalization. Check that traversal sequences are rejected, that temp files are created in a directory the attacker cannot rename or replace, and that rename targets are not attacker-swappable. For security products, confirm the protection covers rename/move/junction on parent directories, not just file contents [E3](https://bugbountylibrary.com/r/h1%3A1003007.md).

## How finders spotted it
- Ran all entitled apps under dtrace, grepped for `getenv` and file strings, found a path-controlling env var, then traced with `fs_usage` to reveal the temp-file-then-rename pattern [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md)
- After a sibling inspector command was fixed, re-reviewed all commands in the same handler and read the concatenation building the temp path, prompting a traversal test [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Noticed AntiRansomware blocked all modifications except rename on the containing folder, hypothesized a swap plus symlink to redirect the privileged delete [E3](https://bugbountylibrary.com/r/h1%3A1003007.md)

## Variants seen
- Env-var-controlled debug file write redirected by a rename race [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md)
- Path traversal via unsanitized filename concatenation in a debug command [E2](https://bugbountylibrary.com/r/h1%3A2995025.md)
- Protected-path swap via unmonitored folder rename plus symlink [E3](https://bugbountylibrary.com/r/h1%3A1003007.md)

## Impact and severity
E1 bypassed TCC to overwrite TCC.db, a sandbox/privacy boundary crossing [E1](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md). E2 gave arbitrary file write outside the temp dir, chained to DLL overwrite for RCE on Windows [E2](https://bugbountylibrary.com/r/h1%3A2995025.md). E3 escalated to SYSTEM-level deletion and tampering with protected backups [E3](https://bugbountylibrary.com/r/h1%3A1003007.md). Impact rises when the primitive is chained to code execution or a security-control bypass, and when the writer runs at high privilege.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html.md
- E2: https://bugbountylibrary.com/r/h1%3A2995025.md
- E3: https://bugbountylibrary.com/r/h1%3A1003007.md