From: "Theodore Tso" <tytso@mit.edu>
To: Nexory <St4yl3r30@hotmail.de>
Cc: linux-ext4@vger.kernel.org
Subject: Re: [PATCH e2fsprogs 0/2] debugfs: fix rdump path-traversal on untrusted images
Date: Mon, 5 Oct 2026 05:01:23 -0400 [thread overview]
Message-ID: <asNnNLWyiZ74Ofas@mit.edu> (raw)
In-Reply-To: <OS6P279MB1180ED8E849B4768423DCF8ECBD12@OS6P279MB1180.NORP279.PROD.OUTLOOK.COM>
On Fri, Aug 07, 2026 at 12:03:02PM -0500, Nexory wrote:
> debugfs "rdump" extracts a directory tree from a filesystem image to a
> destination directory. It copies each raw on-disk directory entry name into
> the output path without checking it, so an entry whose name contains a '/'
> (for example "../escaped") in a crafted or corrupted image is written outside
> the destination directory. A valid ext2/3/4 filesystem never contains such a
> name, and e2fsck already flags it as corruption (PR_2_BAD_NAME), so only
> untrusted or damaged images are affected, which is exactly what debugfs is
> pointed at.
Sorry, I forgot to send an acknowledgement of this when I pushed the
change out earlier, but thanks, I've applied your changes.
- Ted
prev parent reply other threads:[~2026-10-05 9:01 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-07 10:03 [PATCH e2fsprogs 0/2] debugfs: fix rdump path-traversal on untrusted images Nexory
2026-08-07 10:03 ` [PATCH e2fsprogs 1/2] debugfs: reject path-traversal names in rdump Nexory
2026-08-07 10:03 ` [PATCH e2fsprogs 2/2] tests: add d_rdump_safe for the debugfs rdump path-traversal guard Nexory
2026-10-05 9:01 ` Theodore Tso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=asNnNLWyiZ74Ofas@mit.edu \
--to=tytso@mit.edu \
--cc=St4yl3r30@hotmail.de \
--cc=linux-ext4@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.