Impact
An attacker who can influence the Unix-domain socket pathname that a macOS host application passes into UnixType.init(path:) can supply a pathname of 105–252 UTF-8 bytes to overflow the stack-allocated sockaddr_un before any socket syscall runs, corrupting the host process's stack.
This requires a host application to accept an attacker-influenced pathname and forward it to this initializer — for example, through Containerization's Unix-socket relay configuration — rather than being reachable directly from a container guest or a registry. The confirmed effect is stack corruption and process abort under memory-safety instrumentation.
Details
UnixType.init(path:) checks a candidate path's UTF-8 byte length against lengthLimit before copying it into the native sockaddr_un.sun_path field. On macOS that limit was hardcoded to 253 bytes, unrelated to sun_path's actual 104-byte capacity.
In Swift, sockaddr_un has a fixed Swift-visible size, and UnixType.init(path:) stack-allocates exactly that fixed-size value. The initializer then copies nameLength bytes into sun_path via strncpy, so any path accepted by the 253-byte check but longer than 104 bytes overflows past the entire stack-allocated struct, not just past the sun_path field, writing 1–148 attacker-controlled bytes into adjacent stack memory.
Affected code
UnixType.init(path:) in Sources/ContainerizationOS/Socket/UnixType.swift — used a macOS-specific lengthLimit of 253 bytes to gate a copy into the 104-byte sun_path field.
Not affected: the Linux branch of the same initializer, which already derived lengthLimit from sun_path's actual size. Triggering this also requires an application-level path: the in-repository relay call sites (Sources/Containerization/UnixSocketRelay.swift) use host-controlled filesystem paths, so a concrete exploit needs a host application that forwards an attacker-influenced pathname into UnixType.init(path:).
Mitigations
- Upgrade to the version of
apple/containerization containing the fix.
- If you can't upgrade immediately, validate that any Unix-domain socket pathname reaching
UnixType.init(path:) is well under 104 bytes before calling it.
- Don't let externally-influenced values (registry-supplied image metadata, network input, etc.) reach a Unix-socket relay path or any other caller of
UnixType.init(path:) without going through your own length check first.
References
#917
Impact
An attacker who can influence the Unix-domain socket pathname that a macOS host application passes into
UnixType.init(path:)can supply a pathname of 105–252 UTF-8 bytes to overflow the stack-allocatedsockaddr_unbefore any socket syscall runs, corrupting the host process's stack.This requires a host application to accept an attacker-influenced pathname and forward it to this initializer — for example, through
Containerization's Unix-socket relay configuration — rather than being reachable directly from a container guest or a registry. The confirmed effect is stack corruption and process abort under memory-safety instrumentation.Details
UnixType.init(path:)checks a candidate path's UTF-8 byte length againstlengthLimitbefore copying it into the nativesockaddr_un.sun_pathfield. On macOS that limit was hardcoded to 253 bytes, unrelated tosun_path's actual 104-byte capacity.In Swift,
sockaddr_unhas a fixed Swift-visible size, andUnixType.init(path:)stack-allocates exactly that fixed-size value. The initializer then copiesnameLengthbytes intosun_pathviastrncpy, so any path accepted by the 253-byte check but longer than 104 bytes overflows past the entire stack-allocated struct, not just past thesun_pathfield, writing 1–148 attacker-controlled bytes into adjacent stack memory.Affected code
UnixType.init(path:)inSources/ContainerizationOS/Socket/UnixType.swift— used a macOS-specificlengthLimitof 253 bytes to gate a copy into the 104-bytesun_pathfield.Not affected: the Linux branch of the same initializer, which already derived
lengthLimitfromsun_path's actual size. Triggering this also requires an application-level path: the in-repository relay call sites (Sources/Containerization/UnixSocketRelay.swift) use host-controlled filesystem paths, so a concrete exploit needs a host application that forwards an attacker-influenced pathname intoUnixType.init(path:).Mitigations
apple/containerizationcontaining the fix.UnixType.init(path:)is well under 104 bytes before calling it.UnixType.init(path:)without going through your own length check first.References
#917