Using predictable tmp directory

[stahnma]

When building projects with rubyc/ruby-packer., it uses a predictable name, in /tmp. If this is happening, an attacker could put their own payloads and instructions in that location. Additonally, it prevents multiple builds using ruby-packer from happening at the same time on the same system.

[SwagDevOps]

You could use your own location for temp directory, sample of use: tasks/gem/compile#L64.

[0x1eef]

This should be fixed in ruby-packer. It's legitimate security issue.

[0x1eef]

I seen similar in the past with tools like this:

loop do
  File.binwrite "evilpayload", File.join("tmp", "ruby")
end

If this is running all the time, then it's possible due to race condition that ruby-packer launches "evilpayload" instead of ruby.

[0x1eef]

Also more sophisticated solutions at hand using FS events. Which is why i think ruby-packer needs a robust solution to this problem.