REDHAT-BUG-2554410: Low severity Gnome Nautilus vulnerability
Summary: When a mount is unmounted or ejected, Nautilus offers to empty its trash. It deleted the contents of .Trash-$uid/files and .Trash-$uid/info (and .Trash/$uid/...) without checking for symbolic links. A crafted disk image or device that makes these paths symlinks to e.g. the user's home directory causes Nautilus to recursively delete the link target when the user chooses "Empty", which is the dialog's default action.
Requirements to exploit: A crafted disk image (i.e. ISO) or external device (i.e. USB). No access to the system is required
Component affected: nautilus
Version affected: All versions since 2.21
Patch available: Yes
Version fixed (if any already): PR available now
Upstream coordination: https://gitlab.gnome.org/GNOME/nautilus/-/mergerequests/2179
CVSS (optional): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Impact (optional): Arbitrary deletion of any files the user can write, including the entire home directory.
Embargo: No
Acknowledgment: Corey Berla
Steps to reproduce if available:
1. Create an image containing a symlink .Trash-1000/files -> /home/<user> (or another directory) (e.g. xorriso -as mkisofs -R). 2. The user mounts the image (e.g. "Open With → Disk Image Mounter"). 3. The user ejects it from Nautilus and chooses "Empty" (the default action). 4. The contents of the link target are deleted.
Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not choose “Empty” when ejecting or unmounting USB devices or disk images; alternatively, remove the ability to empty the trash upon ejecting them.