CVE-2023-0591

描述

ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory. This issue affects ubi-reader before 0.8.5.

如何修補 CVE-2023-0591

要修補 CVE-2023-0591,請將受影響套件升級到下列已修補版本。

• —升級至 0.8.5 或更新版本
• —升級至 0.8.5 或更新版本

CVE-2023-0591 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 0.8.5
• from 0, < 0.8.5

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-vp2x-3mc3-3cj4
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-0591
• ADVISORYonekey.com/blog/security-advisory-remote-command-execution-in-binwalk/
• PATCHgithub.com/jrspruitt/ubi_reader