CVE-2022-24302 in Paramiko
Summary
by MITRE • 03/18/2022
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/17/2025
The vulnerability identified as CVE-2022-24302 represents a critical race condition flaw within the Paramiko SSH library that affects versions prior to 2.10.1. This issue specifically impacts the write_private_key_file function where a timing window exists between the creation of a private key file and the subsequent modification of its permissions. The race condition occurs when an attacker can potentially access the file during the brief interval between file creation and permission setting, creating a window where sensitive cryptographic material might be exposed to unauthorized parties.
The technical implementation of this vulnerability stems from the improper handling of file system operations within the cryptographic key management process. When Paramiko generates private key files, it first creates the file with default permissions and then attempts to change those permissions to restrict access. However, this two-step process creates a temporal gap where the file exists with potentially insecure permissions, allowing malicious actors to read the key material before the system can properly secure it. This flaw directly relates to CWE-367 which addresses Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities, where the state of a resource changes between the time it is checked and when it is used.
The operational impact of this vulnerability extends beyond simple information disclosure, as private key files contain sensitive cryptographic material that could enable unauthorized access to SSH services and systems. An attacker exploiting this race condition could potentially intercept private key files during their creation, leading to complete compromise of SSH-based authentication mechanisms. This vulnerability particularly affects environments where Paramiko is used for automated key management, configuration management tools, or any system that generates SSH keys programmatically. The risk is compounded in multi-user environments where the timing window could be exploited by processes running with different privileges or by malicious users with access to the system during the vulnerable period.
Organizations utilizing Paramiko versions prior to 2.10.1 should immediately implement mitigation strategies focusing on both immediate remediation and operational hardening. The primary solution involves upgrading to Paramiko version 2.10.1 or later where the race condition has been addressed through improved file handling mechanisms that ensure atomic operations between file creation and permission setting. Additionally, system administrators should implement monitoring for suspicious file access patterns during key generation processes and consider implementing additional file system security controls such as restrictive umask settings and proper file system permissions. The ATT&CK framework categorizes this vulnerability under T1552.001 which covers credentials in files, and organizations should consider implementing detection measures aligned with this tactic to identify potential exploitation attempts. Security teams should also conduct comprehensive audits of systems using Paramiko to identify and remediate any instances where older versions remain in use, particularly in automated environments where key generation occurs frequently.