Executive brief
A vulnerability exists in cramfs-tools, a set of utilities used to create and check compressed file systems often found in embedded devices and Linux distributions. When using the 'cramfsck' tool in its "continue-on-error" mode, the software fails to properly handle existing symbolic links at the extraction destination. This allows an attacker to trick the tool into writing files to unintended locations on the system, potentially leading to unauthorized data modification or system compromise.
Technical details
A symlink following vulnerability (CWE-59) exists in the 'change_file_status' function within 'cramfsck.c' of npitre cramfs-tools up to version 2.2. When the utility is executed with the '-c' (continue-on-error) and '-x' (extract) flags, it fails to abort if the extraction root is a pre-existing symbolic link. Although 'mkdir()' fails, the program continues execution and performs subsequent file operations (such as 'open', 'chmod', and 'utime') through the symlink target. This allows a local attacker to redirect file writes and metadata modifications to arbitrary locations outside the intended directory. The issue was addressed by making 'die()' calls fatal for critical filesystem operations and introducing 'warn_error()' for non-fatal metadata updates.
Affected products
- npitre cramfs-tools up to 2.2
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory
- 2026-05-18: patched: Patch b4a3a695c9873f824907bd15659f2a6ac7667b4f applied to master branch.
References
- https://github.com/npitre/cramfs-tools/
- https://github.com/npitre/cramfs-tools/commit/b4a3a695c9873f824907bd15659f2a6ac7667b4f
- https://github.com/npitre/cramfs-tools/issues/13
- https://github.com/npitre/cramfs-tools/issues/13
- https://vuldb.com/submit/811897
- https://vuldb.com/vuln/364408
- https://vuldb.com/vuln/364408/cti