pxar/container restore target rootfs escape
Affected packages
pve-container, proxmox-backup-client, rust-pxar
Details
An attacker with direct access to a PBS datastore configured as storage on a Proxmox VE host can construct and upload a malicious pxar archive with two root entries.
When such a backup archive was restored by pve-container, the archive contents were written outside of the target rootfs mountpoint. If a container is restored as privileged container, the extraction runs as root.
proxmox-backup-client will now refuse to follow symlinks during extraction of directories or hardlinks.
This issue was reported privately by Project Loupe.
Fixed in
- proxmox-backup-client >= 4.2.7-1
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.