CVE-2024-25711

The vulnerability lies in diffoscope's handling of GPG files. Specifically, diffoscope trusts the value of the gpg --use-embedded-filenames option, which allows a GPG file to contain an embedded filename [1]. This embedded filename is not sanitized, enabling a directory traversal attack. An attacker can craft a GPG file with an embedded filename like ../.ssh/id_rsa, which diffoscope will process and attempt to compare.

Exploitation requires the attacker to supply a malicious GPG file to a user running diffoscope. The attack is achieved because diffoscope version 256 and earlier blindly follows the embedded filename path, without checking for directory traversal sequences [2]. This means the attacker can read any file on the system that the user running diffoscope has access to.

The impact is severe: an attacker can exfiltrate sensitive information, such as SSH private keys (../.ssh/id_rsa), configuration files, or any other accessible file [1]. This could lead to lateral movement or privilege escalation depending on the data obtained. The attack does not require authentication beyond the ability to have the victim process a malicious file.

Mitigation is straightforward: users must upgrade to diffoscope version 256 or later. The issue was patched by properly sanitizing or ignoring the embedded filenames from GPG files [2]. Fedora has also released updates for the affected packages [3]. No workaround exists for older versions, so upgrading is critical.