mirror of
https://github.com/flatpak/flatpak.git
synced 2026-09-17 08:52:11 -04:00
Sebastian Wick
70fdf20886
extract_extra_data() had two vulnerabilities: 1. It resolved "files/extra" using g_file_resolve_relative_path() which follows symlinks. A crafted OSTree commit with "files" as a symlink causes extra-data blobs to be written at the symlink target. On system installs this runs as root via the system helper, which validates signatures and checksums but not tree structure. 2. It used g_file_get_child(extradir, name) where name comes from xa.extra-data-sources in the commit metadata. Names containing ".." escape the extra/ directory. This is exploitable through the normal build flow: flatpak build-export rejects "/" but not "..". Replace GFile path operations with fd-relative operations: open "files" with glnx_chaseat using GLNX_CHASE_RESOLVE_NO_SYMLINKS, create "extra" with glnx_chase_and_mkdirat using GLNX_CHASE_RESOLVE_BENEATH, validate extra-data names against ".", "..", and "/", and write with glnx_file_replace_contents_at anchored to the extra directory fd. [smcv: Open checkoutdir_dfd before trying to open its files subdir] Co-authored-by: Simon McVittie <smcv@collabora.com> Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg