We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:

Download:

Current browse context:

cs.CR

Change to browse by:

References & Citations

DBLP - CS Bibliography

Bookmark

(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: Unsafe at Any Copy: Name Collisions from Mixing Case Sensitivities

Authors: Aditya Basu (1), John Sampson (1), Zhiyun Qian (2), Trent Jaeger (1) ((1) The Pennsylvania State University, (2) University of California, Riverside)
Abstract: File name confusion attacks, such as malicious symbolic links and file squatting, have long been studied as sources of security vulnerabilities. However, a recently emerged type, i.e., case-sensitivity-induced name collisions, has not been scrutinized. These collisions are introduced by differences in name resolution under case-sensitive and case-insensitive file systems or directories. A prominent example is the recent Git vulnerability (CVE-2021-21300) which can lead to code execution on a victim client when it clones a maliciously crafted repository onto a case-insensitive file system. With trends including ext4 adding support for per-directory case-insensitivity and the broad deployment of the Windows Subsystem for Linux, the prerequisites for such vulnerabilities are increasingly likely to exist even in a single system.
In this paper, we make a first effort to investigate how and where the lack of any uniform approach to handling name collisions leads to a diffusion of responsibility and resultant vulnerabilities. Interestingly, we demonstrate the existence of a range of novel security challenges arising from name collisions and their inconsistent handling by low-level utilities and applications. Specifically, our experiments show that utilities handle many name collision scenarios unsafely, leaving the responsibility to applications whose developers are unfortunately not yet aware of the threats. We examine three case studies as a first step towards systematically understanding the emerging type of name collision vulnerability.
Comments: 15 pages, 1 appendix, 2 tables, 12 figures
Subjects: Cryptography and Security (cs.CR); Operating Systems (cs.OS)
Cite as: arXiv:2211.16735 [cs.CR]
  (or arXiv:2211.16735v1 [cs.CR] for this version)

Submission history

From: Aditya Basu [view email]
[v1] Wed, 30 Nov 2022 04:48:07 GMT (338kb,D)

Link back to: arXiv, form interface, contact.