[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250423160205.wndth53pj422sr34@jwilk.net>
Date: Wed, 23 Apr 2025 18:02:05 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: vulnerabilities in busybox tar and cpio tools
* Ian Norton <Ian.Norton@...rust.com>, 2025-04-23 14:11:
>https://security-tracker.debian.org/tracker/CVE-2023-39810
This is: "An issue in the CPIO command of Busybox v1.33.2 allows
attackers to execute a directory traversal."
>see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html
This patch appears to be using a realpath(3)-like function, which is not
a good tool for this purpose. The function is fundamentally racy, as it
could traverse symlinks that are not under your control.
Even worse, on Linux systems you can abuse magic links in /proc to spoof
what realpath(3) returns in a race-free manner (although that works only
against yourself or root). See https://codeberg.org/jwilk/surrealpath
for a proof of concept.
But it seems busybox committed a different patch, which looks good:
https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641
("archival: disallow path traversals (CVE-2023-39810)")
The essence of the patch is:
+#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
+ /* Strip leading "/" and up to last "/../" path component */
+ dst_name = (char *)strip_unsafe_prefix(dst_name);
+#endif
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
