REDHAT-BUG-2523363: Path Traversal
Upstream issue: https://github.com/sosreport/sos/issues/4460 Proposed Fix: https://github.com/sosreport/sos/pull/4461 Component: sos (sos/cleaner/archives/init.py — extractarchive()) CWE: CWE-22 and CWE-59 Suggested CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)
Summary: sos clean extracts a caller-supplied tarball with tarfile.fullytrustedfilter. A dest-containment check exists but only inspects member.name. It does not inspect symlink or hardlink targets. extractall() can therefore write files outside the extract directory as the process UID.
Description: A path traversal vulnerability was found in sos clean in the sos package. The extractarchive() function uses Python's tarfile module with fullytrustedfilter and validates only archive member names against the extraction directory. Symlink and hardlink targets are not validated. A crafted tar archive can therefore contain an out-of-tree symlink followed by a regular file whose apparent path remains within the extraction directory. During extraction, tarfile.extractall() follows the symlink and writes the file to an attacker-controlled location outside the extraction directory. This can result in arbitrary file creation or overwrite with the privileges of the sos clean process, which is commonly run as root.
Reporter / Credit: Sandipan Roy (Red Hat)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sos (sos/cleaner/archives/_init_.py — extract_archive())to a version that resolves this vulnerability.Patch sosreport/sos/pull/4461
Event History
Frequently Asked Questions
Which environments are exposed?
Systems are exposed when sos clean extracts a caller-supplied tar archive. The impact is limited to files writable by the account running the extraction, but extraction can create files outside the intended destination directory.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted tar archive and have it processed by sos clean. The archive uses an unchecked symlink or hardlink target, followed by a file entry that appears to remain inside the extraction directory.
What can be done before a fix is available?
Do not use sos clean to extract untrusted or caller-supplied tar archives. Where extraction is necessary, run the process with the least privileges possible, since out-of-tree files are written with the process UID.