The Apache Storm Worker Launcher setuid-root binary performs ownership and permission adjustments on worker directories by walking the directory tree with FTS and calling lchown and chmod on each entry's full pathname. Because these syscalls re-resolve the path at the time of the call, an untrusted topology user can exploit a TOCTOU race condition by replacing intermediate directory components with symbolic links between classification and the privileged operation. This allows redirection of privileged operations to arbitrary files on the host system. The vulnerability violates the isolation intended by supervisor.run.worker.as.user and container isolation. The issue is fixed in Apache Storm 3.1.0 by modifying the privileged walk to operate on file descriptors obtained from stat calls rather than on pathnames re-resolved at call time. The launcher binary must be rebuilt and reinstalled after upgrading; replacing Java artifacts alone is insufficient.

An untrusted tenant running code on a supervisor node can exploit this TOCTOU race condition to redirect privileged ownership and permission changes to arbitrary files on the host. This can lead to unauthorized modification of files outside the intended worker directories, potentially compromising the host system's security boundaries. The vulnerability undermines the isolation mechanisms intended to separate tenant code from host privileges.

Upgrade Apache Storm to version 3.1.0 or later, where the vulnerability is fixed by using file descriptors for privileged operations instead of pathnames. After upgrading, rebuild and reinstall the worker-launcher binary; replacing Java artifacts alone is insufficient. Until an upgrade is possible, do not run untrusted topology code on supervisors configured with supervisor.run.worker.as.user, as the launcher is the boundary being crossed.