CVE-2022-1664: Debian Dpkg Path Traversal Vulnerability

CVE-2022-1664 Overview

CVE-2022-1664 is a directory traversal vulnerability affecting Dpkg::Source::Archive in dpkg, the Debian package management system. The vulnerability exists in versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

This vulnerability allows attackers to write arbitrary files outside the intended extraction directory, potentially leading to full system compromise through file overwrite attacks.

Critical Impact
Attackers can exploit this directory traversal flaw to write malicious files to arbitrary locations on the filesystem during package extraction, potentially leading to remote code execution or complete system compromise.

Affected Products

Debian dpkg (versions prior to 1.21.8, 1.20.10, 1.19.8, 1.18.26)
Debian Linux 9.0, 10.0, 11.0
NetApp ONTAP Select Deploy Administration Utility

Discovery Timeline

2022-05-26 - CVE-2022-1664 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-1664

Vulnerability Analysis

The vulnerability resides in the Dpkg::Source::Archive module, which handles the extraction of Debian source packages. When processing v2 and v3 format source packages, the module extracts tarball archives including orig.tar and debian.tar files. The extraction routine fails to properly sanitize file paths within these archives, allowing specially crafted tarballs to include path traversal sequences (such as ../) that escape the intended extraction directory.

This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path or directory traversal. The vulnerability is exploitable over the network without authentication or user interaction, making it particularly dangerous in environments where source packages are automatically processed from untrusted sources.

Root Cause

The root cause is insufficient validation of file paths during tarball extraction in the Dpkg::Source::Archive module. The in-place extraction mechanism does not properly sanitize or reject archive entries containing directory traversal sequences. When a malicious tarball contains entries with paths like ../../etc/cron.d/malicious, the extraction process follows these paths literally, writing files outside the intended destination directory.

Attack Vector

The attack vector leverages the network-accessible nature of package repositories and build systems. An attacker can craft a malicious Debian source package containing specially constructed orig.tar or debian.tar archives with directory traversal sequences in their file paths.

The attack scenario typically involves:

Creating a malicious source package with crafted tarball entries containing ../ sequences
Distributing the package through compromised or untrusted repositories
Waiting for a victim system to extract the source package using dpkg-source
Upon extraction, files are written to arbitrary locations on the filesystem

The vulnerability is particularly concerning for build servers, continuous integration systems, and any automated package building infrastructure that processes untrusted source packages.

Detection Methods for CVE-2022-1664

Indicators of Compromise

Unexpected files appearing in system directories after source package extraction operations
Modified system configuration files or cron jobs following dpkg-source operations
Tarball archives in processed packages containing ../ path sequences
File system events showing writes to locations outside expected extraction directories

Detection Strategies

Monitor dpkg-source extraction operations for file writes outside expected directories
Implement file integrity monitoring on critical system directories during package operations
Scan incoming source packages for tarball entries containing path traversal sequences
Review dpkg and apt logs for unusual extraction patterns or errors

Monitoring Recommendations

Enable audit logging for file system operations during package management activities
Configure alerts for modifications to sensitive directories like /etc/, /usr/bin/, and /var/spool/cron/
Implement network monitoring to detect downloads of source packages from untrusted repositories
Deploy endpoint detection to identify post-exploitation activities following successful directory traversal

How to Mitigate CVE-2022-1664

Immediate Actions Required

Update dpkg to a patched version: 1.21.8 or later, 1.20.10 or later, 1.19.8 or later, or 1.18.26 or later depending on your distribution branch
Avoid extracting source packages from untrusted sources until patched
Review and audit any source packages processed since the system was deployed
Implement additional access controls on systems that process source packages automatically

Patch Information

Debian has released security patches addressing this vulnerability. The fixes are documented in multiple commits to the dpkg repository:

For detailed guidance, refer to the official security announcements:

NetApp customers should review the NetApp Security Advisory for guidance on affected ONTAP Select Deploy Administration Utility deployments.

Workarounds

Restrict source package extraction to isolated environments or containers with limited filesystem access
Implement mandatory review processes for source packages before extraction on production systems
Use chroot or namespace isolation when running dpkg-source on untrusted packages
Consider using file system sandboxing tools to restrict extraction operations to specific directories

bash

# Verify dpkg version to ensure patched version is installed
dpkg --version

# Update dpkg on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade dpkg

# Check for vulnerable versions across systems
dpkg-query -W -f='${Package} ${Version}\n' dpkg