Executive brief
proot-distro is a utility used to manage and run Linux distributions within the Termux environment on Android. A security flaw in the backup restoration process allows a specially crafted archive to bypass the isolation between different installed containers. If a user is tricked into restoring a malicious backup file, an attacker could steal sensitive data (such as SSH keys or credentials) from other containers or inject malicious files into them, potentially compromising the integrity of the user's entire container environment.
Technical details
A container isolation bypass exists in proot-distro's 'restore' command due to improper validation of hardlink entries within backup archives. While the utility implements path traversal protections to keep operations within the containers directory, it fails to verify that a hardlink's source container matches the destination container being restored. An attacker can craft a TAR archive containing hardlink entries where the 'linkname' references the root filesystem of a different installed container. When a user restores this archive, the utility will copy files from the targeted 'victim' container into the 'attacker' container (disclosure) or vice versa (injection). This vulnerability is classified under CWE-668 and was addressed in version 5.1.6 by ensuring hardlink sources are restricted to the container currently being processed.
Affected products
- termux proot-distro < 5.1.6
Timeline
- 2026-06-09: patched: Version 5.1.6 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD