TOCTOU Race Condition in boneIO Black Affects User Privileges

CVE-2026-77059

What is CVE-2026-77059?

The boneIO Black product contains a significant vulnerability due to a TOCTOU (Time of Check to Time of Use) race condition within the create_timedatectl_sudoers_file() function. This flaw arises when the function writes sudoers rules to a predictable temporary file, which forges a window of opportunity for local attackers. After the sudoers rules are validated, but before they are installed with root privileges, an attacker may exploit this race condition. They can substitute these rules with malicious content or leverage the predictable filename to execute symlink attacks, enabling arbitrary sudoers rule injection and potentially escalating local privileges to that of the root user. Users are recommended to upgrade to version 1.6.0 or later to mitigate this vulnerability.

References