CVE-2023-7216: 
Linux Ubuntu vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2023-7216) was discovered in the CPIO utility, primarily affecting Unix-like operating systems. The vulnerability was first reported on February 5, 2024. This issue allows a remote unauthenticated attacker to trick users into opening specially crafted archives, which during extraction could follow symlinks outside of the intended directory, enabling files to be written in arbitrary directories through symlinks (NVD, Security Online).

The vulnerability stems from CPIO's handling of symbolic links during the extraction process. By default, CPIO follows stored symlinks within archives without verifying their final destination. The vulnerability has received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The issue is classified under CWE-59 (Improper Link Resolution Before File Access) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

The vulnerability could allow attackers to write files in sensitive locations such as ~/.ssh, ~/.bashrc, or ~/.config/autostart/, potentially leading to unauthorized access, privilege escalation, or remote command execution on the victim's system. The impact extends beyond individual users to software ecosystems that incorporate CPIO as a component (Security Online).

The upstream maintainers have disputed this vulnerability and consider it normal behavior. They recommend using the '--no-absolute-filenames' option as a mitigation, which prevents the attack. This fix will likely be included in RHEL 10, though earlier versions remain unpatched (Debian Tracker, Red Hat Bugzilla).

The vulnerability has sparked discussions in the security community, with some experts noting similarities to a previous vulnerability (CVE-2015-1197). The upstream community has rejected CVE-2023-7216, stating they don't consider it a bug, which has led to debates about its severity rating changes from high to moderate and potentially to low (Red Hat Bugzilla).