Skip to content

Commit e048580

Browse files
committed
Unsquashfs: additional write outside destination directory exploit fix
An issue on github (#72) showed how some specially crafted Squashfs filesystems containing invalid file names (with '/' and '..') can cause Unsquashfs to write files outside of the destination directory. Since then it has been shown that specially crafted Squashfs filesystems that contain a symbolic link pointing outside of the destination directory, coupled with an identically named file within the same directory, can cause Unsquashfs to write files outside of the destination directory. Specifically the symbolic link produces a pathname pointing outside of the destination directory, which is then followed when writing the duplicate identically named file within the directory. This commit fixes this exploit by explictly checking for duplicate filenames within a directory. As directories in v2.1, v3.x, and v4.0 filesystems are sorted, this is achieved by checking for consecutively identical filenames. Additionally directories are checked to ensure they are sorted, to avoid attempts to evade the duplicate check. Version 1.x and 2.0 filesystems (where the directories were unsorted) are sorted and then the above duplicate filename check is applied. Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
1 parent 9938154 commit e048580

File tree

8 files changed

+173
-2
lines changed

8 files changed

+173
-2
lines changed

Diff for: squashfs-tools/Makefile

+4-2
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \
160160
caches-queues-lists.o reader.o tar.o
161161

162162
UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
163-
unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \
164-
compressor.o unsquashfs_info.o
163+
unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o unsquash-12.o \
164+
swap.o compressor.o unsquashfs_info.o
165165

166166
CFLAGS ?= -O2
167167
CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -393,6 +393,8 @@ unsquash-34.o: unsquashfs.h unsquash-34.c unsquashfs_error.h
393393

394394
unsquash-1234.o: unsquash-1234.c unsquashfs_error.h
395395

396+
unsquash-1234.o: unsquash-12.c
397+
396398
unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h unsquashfs_error.h
397399

398400
unsquashfs_info.o: unsquashfs.h squashfs_fs.h unsquashfs_error.h

Diff for: squashfs-tools/unsquash-1.c

+6
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
370370
}
371371
}
372372

373+
/* check directory for duplicate names. Need to sort directory first */
374+
sort_directory(dir);
375+
if(check_directory(dir) == FALSE) {
376+
ERROR("File system corrupted: directory has duplicate names\n");
377+
goto corrupted;
378+
}
373379
return dir;
374380

375381
corrupted:

Diff for: squashfs-tools/unsquash-12.c

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
/*
2+
* Unsquash a squashfs filesystem. This is a highly compressed read only
3+
* filesystem.
4+
*
5+
* Copyright (c) 2021
6+
* Phillip Lougher <phillip@squashfs.org.uk>
7+
*
8+
* This program is free software; you can redistribute it and/or
9+
* modify it under the terms of the GNU General Public License
10+
* as published by the Free Software Foundation; either version 2,
11+
* or (at your option) any later version.
12+
*
13+
* This program is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* GNU General Public License for more details.
17+
*
18+
* You should have received a copy of the GNU General Public License
19+
* along with this program; if not, write to the Free Software
20+
* Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
21+
*
22+
* unsquash-12.c
23+
*
24+
* Helper functions used by unsquash-1 and unsquash-2.
25+
*/
26+
27+
#include "unsquashfs.h"
28+
29+
/*
30+
* Bottom up linked list merge sort.
31+
*
32+
*/
33+
void sort_directory(struct dir *dir)
34+
{
35+
struct dir_ent *cur, *l1, *l2, *next;
36+
int len1, len2, stride = 1;
37+
38+
if(dir->dir_count < 2)
39+
return;
40+
41+
/*
42+
* We can consider our linked-list to be made up of stride length
43+
* sublists. Eacn iteration around this loop merges adjacent
44+
* stride length sublists into larger 2*stride sublists. We stop
45+
* when stride becomes equal to the entire list.
46+
*
47+
* Initially stride = 1 (by definition a sublist of 1 is sorted), and
48+
* these 1 element sublists are merged into 2 element sublists, which
49+
* are then merged into 4 element sublists and so on.
50+
*/
51+
do {
52+
l2 = dir->dirs; /* head of current linked list */
53+
cur = NULL; /* empty output list */
54+
55+
/*
56+
* Iterate through the linked list, merging adjacent sublists.
57+
* On each interation l2 points to the next sublist pair to be
58+
* merged (if there's only one sublist left this is simply added
59+
* to the output list)
60+
*/
61+
while(l2) {
62+
l1 = l2;
63+
for(len1 = 0; l2 && len1 < stride; len1 ++, l2 = l2->next);
64+
len2 = stride;
65+
66+
/*
67+
* l1 points to first sublist.
68+
* l2 points to second sublist.
69+
* Merge them onto the output list
70+
*/
71+
while(len1 && l2 && len2) {
72+
if(strcmp(l1->name, l2->name) <= 0) {
73+
next = l1;
74+
l1 = l1->next;
75+
len1 --;
76+
} else {
77+
next = l2;
78+
l2 = l2->next;
79+
len2 --;
80+
}
81+
82+
if(cur) {
83+
cur->next = next;
84+
cur = next;
85+
} else
86+
dir->dirs = cur = next;
87+
}
88+
/*
89+
* One sublist is now empty, copy the other one onto the
90+
* output list
91+
*/
92+
for(; len1; len1 --, l1 = l1->next) {
93+
if(cur) {
94+
cur->next = l1;
95+
cur = l1;
96+
} else
97+
dir->dirs = cur = l1;
98+
}
99+
for(; l2 && len2; len2 --, l2 = l2->next) {
100+
if(cur) {
101+
cur->next = l2;
102+
cur = l2;
103+
} else
104+
dir->dirs = cur = l2;
105+
}
106+
}
107+
cur->next = NULL;
108+
stride = stride << 1;
109+
} while(stride < dir->dir_count);
110+
}

Diff for: squashfs-tools/unsquash-1234.c

+21
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,24 @@ void squashfs_closedir(struct dir *dir)
7272

7373
free(dir);
7474
}
75+
76+
77+
/*
78+
* Check directory for duplicate names. As the directory should be sorted,
79+
* duplicates will be consecutive. Obviously we also need to check if the
80+
* directory has been deliberately unsorted, to evade this check.
81+
*/
82+
int check_directory(struct dir *dir)
83+
{
84+
int i;
85+
struct dir_ent *ent;
86+
87+
if(dir->dir_count < 2)
88+
return TRUE;
89+
90+
for(ent = dir->dirs, i = 0; i < dir->dir_count - 1; ent = ent->next, i++)
91+
if(strcmp(ent->name, ent->next->name) >= 0)
92+
return FALSE;
93+
94+
return TRUE;
95+
}

Diff for: squashfs-tools/unsquash-2.c

+16
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
static squashfs_fragment_entry_2 *fragment_table;
3030
static unsigned int *uid_table, *guid_table;
3131
static squashfs_operations ops;
32+
static int needs_sorting = FALSE;
3233

3334

3435
static void read_block_list(unsigned int *block_list, long long start,
@@ -463,6 +464,17 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
463464
}
464465
}
465466

467+
if(needs_sorting)
468+
sort_directory(dir);
469+
470+
/* check directory for duplicate names and sorting */
471+
if(check_directory(dir) == FALSE) {
472+
if(needs_sorting)
473+
ERROR("File system corrupted: directory has duplicate names\n");
474+
else
475+
ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
476+
goto corrupted;
477+
}
466478
return dir;
467479

468480
corrupted:
@@ -596,6 +608,10 @@ int read_super_2(squashfs_operations **s_ops, void *s)
596608
* 2.x filesystems use gzip compression.
597609
*/
598610
comp = lookup_compressor("gzip");
611+
612+
if(sBlk_3->s_minor == 0)
613+
needs_sorting = TRUE;
614+
599615
return TRUE;
600616
}
601617

Diff for: squashfs-tools/unsquash-3.c

+6
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
497497
}
498498
}
499499

500+
/* check directory for duplicate names and sorting */
501+
if(check_directory(dir) == FALSE) {
502+
ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
503+
goto corrupted;
504+
}
505+
500506
return dir;
501507

502508
corrupted:

Diff for: squashfs-tools/unsquash-4.c

+6
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,12 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
434434
}
435435
}
436436

437+
/* check directory for duplicate names and sorting */
438+
if(check_directory(dir) == FALSE) {
439+
ERROR("File system corrupted: directory has duplicate names or is unsorted\n");
440+
goto corrupted;
441+
}
442+
437443
return dir;
438444

439445
corrupted:

Diff for: squashfs-tools/unsquashfs.h

+4
Original file line numberDiff line numberDiff line change
@@ -293,4 +293,8 @@ extern long long *alloc_index_table(int);
293293
/* unsquash-1234.c */
294294
extern int check_name(char *, int);
295295
extern void squashfs_closedir(struct dir *);
296+
extern int check_directory(struct dir *);
297+
298+
/* unsquash-12.c */
299+
extern void sort_directory(struct dir *);
296300
#endif

0 commit comments

Comments
 (0)