CVE-2020-24654: 
NixOS vulnerability analysis and mitigation

CVE-2020-24654 affects KDE Ark versions before 20.08.1, where a maliciously crafted TAR archive containing symlink entries could install files outside the extraction directory. The vulnerability was discovered by Fabian Vogt and disclosed on August 27, 2020. The issue affects multiple Linux distributions including Ubuntu, Debian, Fedora, and openSUSE that package the Ark archive manager (KDE Advisory, Ubuntu Notice).

The vulnerability stems from improper handling of symbolic links in TAR archive files. When extracting archives, Ark did not properly verify symlinks, which could lead to file writes outside the intended extraction directory. The vulnerability has a CVSS v3.1 Base Score of 3.3 (LOW) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, and a CVSS v2.0 Base Score of 4.3 (MEDIUM) (NVD).

An attacker could exploit this vulnerability by crafting a malicious TAR archive that, when extracted, would write files outside the intended extraction directory. This could lead to the installation of files anywhere in the user's home directory, potentially including modified .bashrc files or malicious scripts in the ~/.config/autostart directory (KDE Advisory, Gentoo Security).

The vulnerability requires user interaction to exploit, as the victim must extract a maliciously crafted TAR archive using Ark. A proof of concept exploit was made available at https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar (KDE Advisory).

The vulnerability was fixed in Ark version 20.08.1 by implementing proper symlink verification during archive extraction. The fix involves passing the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive. For earlier versions, users were advised to inspect archives for symlink entries pointing outside the extraction folder before extraction and avoid using the 'Extract' context menu from the Dolphin file manager (KDE Advisory, GitHub Commit).