dispatch-conf in Portage 2.0.51-r2 and previous versions allows local users to overwrite arbitrary files via a symlink attack on temporary files.
gentoo linux