Описание
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
A flaw was found in decompress. An attacker can craft a malicious archive that, when extracted, allows for arbitrary hardlink creation. This vulnerability occurs because the x.linkname field from hardlink entries in the archive is processed without proper validation, enabling an attacker to create a hardlink to any file on the same filesystem. This could lead to sensitive file read disclosure or file corruption on the system.
Отчет
This Moderate flaw in the decompress library allows an attacker to create arbitrary hardlinks during archive extraction. By crafting a malicious archive, an attacker could exploit this to disclose sensitive file contents or corrupt files on the same filesystem where the archive is extracted. This risk is present in Red Hat products that utilize the decompress library for archive handling.
Upstream scores I:N, but Red Hat assigns I:L because a hardlink to an absolute path shares the target’s inode, so writes through the extracted name can corrupt or overwrite the original file, not only disclose its contents.
Меры по смягчению последствий
To mitigate this issue, avoid extracting archives from untrusted or unknown sources. When processing archives from potentially untrusted origins, consider using a sandboxed environment to limit the impact of any malicious content.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Fix deferred | ||
| Red Hat Build of Keycloak | decompress | Fix deferred | ||
| Red Hat Hardened Images | dotnet8-0-main-8.0.128-1.1.hum1 | Fixed | RHSA-2026:37577 | 10.07.2026 |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
6.1 Medium
CVSS3