pxar/container restore target rootfs escape
Betroffene Pakete
pve-container, proxmox-backup-client, rust-pxar
Details
An attacker with direct access to a PBS datastore configured as storage on a Proxmox VE host can construct and upload a malicious pxar archive with two root entries.
When such a backup archive was restored by pve-container, the archive contents were written outside of the target rootfs mountpoint. If a container is restored as privileged container, the extraction runs as root.
proxmox-backup-client will now refuse to follow symlinks during extraction of directories or hardlinks.
This issue was reported privately by Project Loupe.
Behoben in
- proxmox-backup-client >= 4.2.7-1
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.