TOCTOU Race Condition in Snowflake Golang Driver Affects Users

CVE-2025-46327

What is CVE-2025-46327?

The Snowflake Golang driver, gosnowflake, is susceptible to a Time-of-Check to Time-of-Use (TOCTOU) race condition that affects versions from 1.7.0 to 1.12.2. This vulnerability arises when the Driver reads logging configuration from a user-specified file on Linux and macOS systems. Despite verifying that the configuration file is writable only by its owner, it is vulnerable to a TOCTOU race condition that may allow a local attacker to exploit this flaw. An attacker with write access to the configuration file or its directory could overwrite the configuration settings, gaining unauthorized control over logging levels and output locations. The issue has been addressed in version 1.13.3.

References