GHSA-w3xf-j2r2-gv4x
CVE Information
Operator-supplied DIRECTORY options are resolved with an ownership walk that follows a symlink component only when it is owned by uid 0 or by the process euid. On a DAEMON that ownership test is not sufficient on its own: an in-module symlink owned by uid 0 or by the daemon euid is followed by design, so a peer-supplied --partial-dir or --backup-dir whose literal value passes the daemon filter check could resolve THROUGH that symlink to a location outside the module's own path.
PRECONDITIONS, which bound this considerably:
- A symlink the ownership rule ALREADY trusts (owned by uid 0 or by the daemon euid) must exist at a point the peer can route through. The peer does not get to plant it; that is what makes this AC:H.
- Default symlink munging makes remotely received symlinks inert, and even with munging disabled an unchrooted daemon still sanitizes received symlink targets. Disabling munging increases usable-symlink exposure but does not by itself let a peer create an out-of-module target.
Within those preconditions the peer can read files (by having them used as a delta basis), or overwrite, rename or unlink them, outside the module root. Reach is bounded by what lies beneath the trusted symlink and is accessible to the daemon euid -- it is not arbitrary access to the whole host filesystem.
SCOPE: --partial-dir and --backup-dir are the routes demonstrated by the tests above. --temp-dir/-T and the --link-dest / --compare-dest / --copy-dest basis lookup share the same resolver and are fixed by the same change, but no separate escape was demonstrated through them, so no claim is made for them.
Fixed by mapping each resolved absolute component back to module-relative and refusing any component that escapes the module root, and by routing the partial-dir basis read, the one-inplace staging open, the basis unlink and the delayed-update rename through the boundary-aware walk.
The wider operator-path directory hardening this sits inside is defence-in-depth and is not part of this item.
Affected: 2.6.3 through 3.4.4 via --partial-dir, 2.3.3 through 3.4.4 via --backup-dir. Those are the two routes actually demonstrated; see the scope note below.
Fixed in: 3.5.0 (operator-path boundary work; the resolver now refuses any component that escapes the module root)
Reporter: Omar Elsayed (seks99x)
Tests: operator-path-dir-daemon-inmodule, operator-path-dir-daemon-leaf, operator-path-dir-daemon-mkdir, operator-path-dir-daemon-outside, operator-path-backup-dir-daemon, operator-path-partial-dir-daemon