CVE-2021-35939: Medium severity RPM RPM vulnerability

In response to CVE-2017-7500 and CVE-2017-7501, it was decided that the policy of RPM is "Only follow directory symlinks owned by target directory owner or root." [1]. This check was only implemented for the parent directory of the file to be created. If an untrusted user owns another ancestor directory, the problem remains unfixed.

An actual exploit requires that a similar directory structure exists both at the location where RPM operates and for the files the attacker wants to get control over. Packages with such paths do exist in the real world, however. For example, in openSUSE both matomo and icinga2 ship a 'Pdo/Mysql.php' somewhere in the file system, with different ownership. A compromised 'matomo' user can create a symlink /srv/www/matomo/core/Tracker/Db -> /usr/share/icingaweb2/library/vendor/Zend/Db/Adapter/ and on the next update of matomo, RPM would replace the 'Pdo/Mysql.php' of icinga2 and give ownership of it to the 'matomo' user.

A fix for this requires a messy ball of code using OPATH to manually walk the whole directory structure and manually resolving symlinks, like in [1] and [2].

References:

1: https://github.com/systemd/systemd/blob/a5648b809457d120500b2acb18b31e2168a4817a/src/basic/fs-util.c#L716 2: https://build.suse.de/package/viewfile/SUSE:Maintenance:13179/permissions.SUSESLE-15-SP1Update/0007-chkstat-fix-privesc-CVE-2019-3690.patch?expand=1 3. https://bugzilla.suse.com/showbug.cgi?id=1157883