Hi Debian/apt security team, I found several security issues in apt (tested on apt 3.0.0). I am reporting them responsibly before any public disclosure.
Summary: 1. Symlink attack on apt crash-report path (CVE-APT-001) File: apt-private/private-install.cc → WriteApportReport() When solver 3.0 fails, apt writes to /var/crash/apt-edsp.<uid>.crash using std::ofstream(..., trunc) and chmod() without O_NOFOLLOW/lchmod. Note: default Linux fs.protected_symlinks=1 mitigates the obvious /var/crash attack vector, but the unsafe pattern remains exploitable when Dir::Apport points to a non-sticky directory or when protected_symlinks is disabled. 2. Command injection via PAGER / APT_PAGER (CVE-APT-002) File: apt-private/private-output.cc → DeterminePager/InitOutputPager apt executes PAGER through /bin/sh -c, allowing arbitrary shell command injection when apt runs as root. 3. Command injection in apt-get source (CVE-APT-003) File: apt-private/private-source.cc Package filename is interpolated into a system() shell command, allowing command injection via malicious package metadata. Live verification: - CVE-APT-001 was reproduced live in Docker (see live-poc/). - CVE-APT-002 was verified live on apt 3.0.0. - CVE-APT-003 was confirmed by source-code review. Full write-ups and PoC scripts are available here (Google Drive): https://drive.google.com/file/d/1x1-cNVcWDBIkgphRZjnFShAg0DVMtuyp/view?usp=sharing Suggested fixes: - Open crash files with O_NOFOLLOW/O_EXCL and use fchmod. - Do not invoke the pager through /bin/sh -c. - Avoid system() with unsanitized filenames in apt-get source. I am not planning to publish these findings until you have had reasonable time to evaluate and patch them. Please let me know if you would like CVE coordination or additional details. Best regards, Badr Azeez
