Hardlink Arbitrary File Read in Decompress

Mitigation Strategies

To mitigate this vulnerability, you should upgrade decompress to version 4.2.2 or later, where the issue with arbitrary hardlink creation during archive extraction is fixed.

Avoid extracting archives from untrusted sources until the update is applied, as crafted archives can create hardlinks that allow reading or overwriting files on the same filesystem.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in decompress versions before 4.2.2, where arbitrary hardlink creation is possible during archive extraction.

When processing hardlink entries, the x.linkname field from the archive is passed directly to the filesystem link function without validation.

An attacker can craft an archive containing a hardlink entry whose linkname is an absolute path to any file on the same filesystem.

This results in the creation of a hardlink inside the extraction directory that shares the same inode as the target file, allowing reading and overwriting of the original file's content.

Hardlinks are limited to files on the same filesystem and cannot target directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of file contents and file corruption.

An attacker can read sensitive files by creating hardlinks to them during archive extraction.

Additionally, the attacker can overwrite important files, potentially causing data loss or system instability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to create hardlinks to arbitrary files on the same filesystem during archive extraction, enabling unauthorized reading and overwriting of sensitive files.

This can lead to disclosure of sensitive information such as secrets or private keys, which may include personal data protected under regulations like GDPR or sensitive health information under HIPAA.

Such unauthorized access and potential data corruption could result in non-compliance with these standards, as they require protection of data confidentiality and integrity.

Therefore, exploiting this vulnerability could cause violations of data protection requirements mandated by common standards and regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves arbitrary hardlink creation during archive extraction using the decompress package (versions <= 4.2.1). Detection involves identifying if archives being extracted contain hardlink entries with absolute paths that point outside the extraction directory.

To detect exploitation attempts or presence of malicious archives, you can inspect tar or other archive files for hardlink entries with absolute paths.

• Use tar command to list hardlink entries and their link targets: tar -tvf archive.tar | grep 'link'
• Check for hardlink entries with absolute paths (paths starting with '/') in the archive listing.
• After extraction, use find to identify hardlinks in the extraction directory: find /path/to/extract -type f -links +1 -exec ls -li {} +

Monitoring file system activity for creation of hardlinks pointing outside expected directories may also help detect exploitation.

Since the vulnerability is in decompress package versions <= 4.2.1, verifying the version of decompress used in your environment is critical.

Useful 0 Not Useful 0