GHSA-7h3g-4w2f-fj2f proot-distro has a Container Isolation Bypass via Crafted Restore Archive
Affected Component**Package:** proot-distro**Affected command:** `restore`**Attack surface:** Host-side Termux CLI processing a user-supplied backup archive**Vulnerability type:** Container Isolation Bypass / Cross-Container Read and WriteAffected Versions| Component | Version |
|---|---|
| proot-distro | 5.1.5 (confirmed affected) |
| Test distro | Alpine Linux |
| Architecture | aarch64 |
| Device | Samsung Galaxy A23 |
| Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |SummaryWhen restoring a crafted backup archive, `proot-distro restore` accepts hardlink entries whose source path references a different installed container.The restore logic resolves the hardlink source from the archive's `linkname` field and copies the referenced file into the container identified by the archive entry.Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.Proof of Concept #1 — Cross-Container File DisclosureAll testing was performed using self-owned containers and harmless marker data only.Step 1 — Create a victim container and marker fileVerification:Step 2 — Create an attacker containerStep 3 — Build a crafted archiveStep 4 — Restore the crafted archiveStep 5 — Read the copied file from the attacker containerObserved output:This demonstrates that data originating from the victim container was copied into the attacker container solely through a crafted restore archive.Proof of Concept #2 — Cross-Container File InjectionStep 1 — Create attacker-controlled source dataStep 2 — Create a victim containerStep 3 — Build a crafted archiveStep 4 — Restore the crafted archiveStep 5 — Verify file injection into the victim containerObserved output:This demonstrates that attacker-controlled data can be copied into a different installed container solely through a crafted restore archive.ImpactAn attacker who can convince a user to restore a crafted backup archive can bypass the expected isolation boundary between installed proot-distro containers.Observed impacts include:Disclosure of files from other installed containers.Injection of attacker-controlled files into other installed containers.Exposure of SSH private keys.Exposure of API credentials.Exposure of configuration files containing secrets.Exposure of application databases stored inside container rootfs directories.The issue does not escape the proot-distro containers directory but allows archive-controlled movement of data across otherwise isolated containers.Root CauseDuring hardlink processing, the restore implementation resolves the source container from the archive's `linkname` field.The resolved path is validated to remain inside a container directory, but the implementation does not verify that the hardlink source container is the same container currently being restored.As a result, archive-controlled metadata determines which installed container is used as the source of the copy operation.Proposed FixThis preserves existing path traversal protections while restoring the expected isolation boundary between containers.Additional NotesIssue reproduced on the official Termux package repository.No root access was used.No third-party data was accessed.Testing used only self-owned containers and harmless marker data.Cross-container disclosure reproduced using the marker value `PROOF-12345`.Cross-container file injection reproduced using the marker value `ATTACKER_DATA`.
CVSS v3.1 score: 8.2