Description
The tar extraction logic in internal/update/extract.go is vulnerable to a chained symbolic link escape. While the current implementation performs lexical checks to ensure paths remain within the destination directory (using ilepath.Join and similar string-based collapsing), it fails to account for the actual resolution on the filesystem.
Since the extraction process writes files using paths that follow real filesystem symlinks without employing O_NOFOLLOW, an attacker can craft a malicious archive containing a chain of symlinks that resolve progressively outside the target directory. For example:
- � $\rightarrow$ . (resolves to destination, passes check)
- � $\rightarrow$ �/.. (lexically collapses to destination, but on disk resolves to parent of destination)
- c $\rightarrow$ �/.. (resolves further out)
Impact
This vulnerability allows for arbitrary file writes as the user executing zero upgrade. Because this command is frequently run with elevated privileges for system-wide installations, this can be leveraged to achieve root or administrator level persistence on the host system.
Recommended Fixes
- Strict Rejection: Reject any archive entry of type ar.TypeSymlink in release archives entirely, matching the security posture of the zip extraction path.
- Rooted Descriptors: Implement extraction using an openat-relative descriptor chain rooted at the destination directory, ensuring O_NOFOLLOW is applied to every component of the path to prevent traversal via symlinks.
- Identity Verification: Ensure the promotion stage continues to use the existing descriptor-bound rename and O_NOFOLLOW checks already present in internal/update/stage_other.go.
Description
The tar extraction logic in internal/update/extract.go is vulnerable to a chained symbolic link escape. While the current implementation performs lexical checks to ensure paths remain within the destination directory (using ilepath.Join and similar string-based collapsing), it fails to account for the actual resolution on the filesystem.
Since the extraction process writes files using paths that follow real filesystem symlinks without employing O_NOFOLLOW, an attacker can craft a malicious archive containing a chain of symlinks that resolve progressively outside the target directory. For example:
Impact
This vulnerability allows for arbitrary file writes as the user executing zero upgrade. Because this command is frequently run with elevated privileges for system-wide installations, this can be leveraged to achieve root or administrator level persistence on the host system.
Recommended Fixes