CVE-2022-0315: Exposure of Resource to Wrong Sphere (CWE-668)
value: Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.5
Published: 2022-03-24T09:15Z
Repository: https://github.com/horovod/horovod
Language: Python
Files changed: horovod/runner/js_run.py, test/single/test_run.py, test/utils/common.py
Commit date: 2022-01-16 11:15:40 +0100
Commit message: Replaced use of tempfile.mktemp() with tempfile.mkstemp() (#3358)

Signed-off-by: Abin Shahab <ashahab@linkedin.com>
Diff: diff --git a/horovod/runner/js_run.py b/horovod/runner/js_run.py
index d25f5dd..5be6801 100644
--- a/horovod/runner/js_run.py
+++ b/horovod/runner/js_run.py
@@ -124,11 +124,16 @@ def generate_jsrun_rankfile(settings, path=None):
     if remaining_slots != 0:
         raise ValueError('Not enough slots on the hosts to fulfill the {slots} requested.'.format(
             slots=settings.num_proc))
 
     # Generate rankfile
-    path = tempfile.mktemp() if path is None else path
+    # using mkstemp here instead of insecure mktemp.
+    # note that the caller is responsible for cleaning up this file
+    if path is None:
+        fd, path = tempfile.mkstemp()
+        fd.close()
+
     with open(path, 'w') as tmp:
         tmp.write('overlapping_rs: allow\n')
         tmp.write('cpu_index_using: logical\n')
         rank = 0
         for host, slots in validated_list:
diff --git a/test/single/test_run.py b/test/single/test_run.py
index f7a82cd..5f506f9 100644
--- a/test/single/test_run.py
+++ b/test/single/test_run.py
@@ -638,11 +638,11 @@ class RunTests(unittest.TestCase):
         test("IBM Spectrum MPI", _SMPI_IMPL)
 
         test(("HYDRA build details:\n"
               "    Version:           3.3a2\n"
               "    Configure options: 'MPICHLIB_CFLAGS=-g -O2'\n"), _MPICH_IMPL)
-        
+
         test("Intel(R) MPI", _IMPI_IMPL)
 
         test("Unknown MPI v1.00", _UNKNOWN_IMPL)
 
         test("output", exit_code=1, expected=_MISSING_IMPL)
diff --git a/test/utils/common.py b/test/utils/common.py
index 038ed1e..77871c4 100644
--- a/test/utils/common.py
+++ b/test/utils/common.py
@@ -110,19 +110,16 @@ def tempdir():
         shutil.rmtree(dirpath)
 
 
 @contextlib.contextmanager
 def temppath():
-    path = tempfile.mktemp()
+    dir_path = tempfile.TemporaryDirectory()
+    path = os.path.join(dir_path.name,'temp_test_file')
     try:
         yield path
     finally:
-        if os.path.exists(path):
-            if os.path.isfile(path):
-                os.remove(path)
-            else:
-                shutil.rmtree(path)
+        dir_path.cleanup()
 
 
 @contextlib.contextmanager
 def override_args(tool=None, *args):
     old = sys.argv[:]

Vulnerable code:     path = tempfile.mktemp() if path is None else path
        
    path = tempfile.mktemp()
        if os.path.exists(path):
            if os.path.isfile(path):
                os.remove(path)
            else:
                shutil.rmtree(path)
Fixed code:     # using mkstemp here instead of insecure mktemp.
    # note that the caller is responsible for cleaning up this file
    if path is None:
        fd, path = tempfile.mkstemp()
        fd.close()


    dir_path = tempfile.TemporaryDirectory()
    path = os.path.join(dir_path.name,'temp_test_file')
        dir_path.cleanup()