GHSA-9xq3-3fqg-4vg7: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Repository: termux/proot-distro Component: proot_distro/commands/install.py → _extract_plain_tar(); also helpers/docker.py → _apply_layer() Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 (confirmed vulnerable) | | Termux app | 0.119.0-beta.3 | | Device / ABI | Samsung Galaxy A23 / aarch64 | | Python (host) | 3.13 | Vulnerability Description proot-distro install extracts a plain tarball rootfs by calling _extract_plain_tar() in proot_distro/commands/install.py. This function correctly rejects tar member names containing .. components, but applies no equivalent check on symlink targets (member.linkname). A tar archive can therefore: 1. Plant a symlink inside the rootfs whose target is an absolute host path (e.g. /data/data/com.termux/files/home). 2. Write a subsequent regular-file member whose path traverses through that symlink name. Python's open() follows the symlink, writing the file on the host filesystem at the privilege level of the Termux process — entirely during proot-distro install, before the container is ever run. The same _extract_plain_tar function is reachable via proot-distro reset, and the equivalent _apply_layer in helpers/docker.py contains the same flaw. Vulnerable Code **proot_distro/commands/install.py**, _extract_plain_tar(): elif member.issym(): linkname taken verbatim from archive — no validation of target os.symlink(member.linkname, dest) # ← symlink planted on host elif member.isreg(): dest = os.path.join(rootfs_dir, rel_path) with open(dest, 'wb') as out: # ← follows symlink above ... The existing traversal guard only covers member names: if any(p in ('..', '') for p in rel_parts): continue # only checks the name, not the symlink target There is no check on member.linkname. An absolute symlink target bypasses this guard entirely. | Check | Member name (rel_path) | Symlink target (member.linkname) | |------------------------------------|:--------------------