A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

Upstream issue: https://github.com/sosreport/sos/issues/4460 Proposed Fix: https://github.com/sosreport/sos/pull/4461 Component: sos (sos/cleaner/archives/init.py — extractarchive()) CWE: CWE-22 and CWE-59 Suggested CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)

Summary: sos clean extracts a caller-supplied tarball with tarfile.fullytrustedfilter. A dest-containment check exists but only inspects member.name. It does not inspect symlink or hardlink targets. extractall() can therefore write files outside the extract directory as the process UID.

Description: A path traversal vulnerability was found in sos clean in the sos package. The extractarchive() function uses Python's tarfile module with fullytrustedfilter and validates only archive member names against the extraction directory. Symlink and hardlink targets are not validated. A crafted tar archive can therefore contain an out-of-tree symlink followed by a regular file whose apparent path remains within the extraction directory. During extraction, tarfile.extractall() follows the symlink and writes the file to an attacker-controlled location outside the extraction directory. This can result in arbitrary file creation or overwrite with the privileges of the sos clean process, which is commonly run as root.

Reporter / Credit: Sandipan Roy (Red Hat)