Executive brief
mport is the package manager for MidnightBSD systems. Prior to version 2.7.8, a local attacker could exploit directory handling during privileged package installation to create directories or modify permissions on arbitrary paths outside the intended package directories using symlink substitution or path traversal techniques. This could allow unauthorized modification of system files or directories during package operations.
Technical details
The vulnerability exists in libmport/bundle_read_install_pkg.c where directory assets marked as ASSET_DIR or ASSET_DIR_OWNER_MODE were processed using path-based operations without proper validation. The vulnerable code used mport_mkdirp(), ownership, and permission operations on user-supplied paths without sanitizing ".." traversal components or validating symlink targets. A local attacker with write access to parts of the target installation tree could exploit race conditions or substitute symlinks to cause directory creation or attribute modifications affecting attacker-selected paths. The fix (version 2.7.8) hardens the code by using openat()-based relative path operations anchored to the install root, rejecting ".." components, and using O_NOFOLLOW to prevent symlink attacks.
Affected products
- MidnightBSD mport prior to 2.7.8
Timeline
- 2026-09-17: disclosed
- 2026-04-23: patched: Fixed in version 2.7.8 via commit a4fa996