An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.
GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (stack corruption) or possibly have unspecified other impact via a crafted file folder.
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive.
Summary: When a mount is unmounted or ejected, Nautilus offers to empty its trash. It deleted the contents of .Trash-$uid/files and .Trash-$uid/info (and .Trash/$uid/...) without checking for symbolic links. A crafted disk image or device that makes these paths symlinks to e.g. the user's home directory causes Nautilus to recursively delete the link target when the user chooses "Empty", which is the dialog's default action.
Requirements to exploit: A crafted disk image (i.e. ISO) or external device (i.e. USB). No access to the system is required
Component affected: nautilus
Version affected: All versions since 2.21
Patch available: Yes
Version fixed (if any already): PR available now
Upstream coordination: https://gitlab.gnome.org/GNOME/nautilus/-/mergerequests/2179
CVSS (optional): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Impact (optional): Arbitrary deletion of any files the user can write, including the entire home directory.
Embargo: No
Acknowledgment: Corey Berla
Steps to reproduce if available:
1. Create an image containing a symlink .Trash-1000/files -> /home/<user> (or another directory) (e.g. xorriso -as mkisofs -R). 2. The user mounts the image (e.g. "Open With → Disk Image Mounter"). 3. The user ejects it from Nautilus and chooses "Empty" (the default action). 4. The contents of the link target are deleted.
Mitigation if available: Do not choose "Empty" or remove the ability to "Empty Trash" upon ejecting USB devices