Advisoriesby Ibis`UnixType.init(path:)` uses a macOS length limit longer than the `sockaddr_un.sun_path` buffer it copies into
Impact
An attacker who can influence the Unix-domain socket pathname that a macOS host application passes into UnixType.init(path:) can supply a pathname of 105–252 UTF-8 bytes to overflow the stack-allocated sockaddr_un before any socket syscall runs, corrupting the host process's stack.
This requires a host application to accept an attacker-influenced pathname and forward it to this initializer — for example, through Containerization's Unix-socket relay configuration — rather than being reachable directly from a container guest or a registry. The confirmed effect is stack corruption and process abort under memory-safety instrumentation.
Details
UnixType.init(path:) checks a candidate path's UTF-8 byte length against lengthLimit before copying it into the native sockaddr_un.sun_path field. On macOS that limit was hardcoded to 253 bytes, unrelated to sun_path's actual 104-byte capacity.
In Swift, sockaddr_un has a fixed Swift-visible size, and UnixType.init(path:) stack-allocates exactly that fixed-size value. The initializer then copies nameLength bytes into sun_path via strncpy, so any path accepted by the 253-byte check but longer than 104 bytes overflows past the entire stack-allocated struct, not just past the sun_path field, writing 1–148 attacker-controlled bytes into adjacent stack memory.
Affected code
UnixType.init(path:)...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apple/containerization Product | < 0.45.0 | 0.45.0 |
Details and references
## Impact An attacker who can influence the Unix-domain socket pathname that a macOS host application passes into `UnixType.init(path:)` can supply a pathname of 105–252 UTF-8 bytes to overflow the stack-allocated `sockaddr_un` before any socket syscall runs, corrupting the host process's stack. This requires a host application to accept an attacker-influenced pathname and forward it to this initializer — for example, through `Containerization`'s Unix-socket relay configuration — rather than being reachable directly from a container guest or a registry. The confirmed effect is stack corruption and process abort under memory-safety instrumentation. ## Details `UnixType.init(path:)` checks a candidate path's UTF-8 byte length against `lengthLimit` before copying it into the native `sockaddr_un.sun_path` field. On macOS that limit was hardcoded to 253 bytes, unrelated to `sun_path`'s actual 104-byte capacity. In Swift, `sockaddr_un` has a fixed Swift-visible size, and `UnixType.init(path:)` stack-allocates exactly that fixed-size value. The initializer then copies `nameLength` bytes into `sun_path` via `strncpy`, so any path accepted by the 253-byte check but longer than 104 bytes overflows past the entire stack-allocated struct, not just past the `sun_path` field, writing 1–148 attacker-controlled bytes into adjacent stack memory. ## Affected code - `UnixType.init(path:)` in `Sources/ContainerizationOS/Socket/UnixType.swift` — used a macOS-specific `lengthLimit` of 253 bytes to gate a copy into the 104-byte `sun_path` field. Not affected: the Linux branch of the same initializer, which already derived `lengthLimit` from `sun_path`'s actual size. Triggering this also requires an application-level path: the in-repository relay call sites (`Sources/Containerization/UnixSocketRelay.swift`) use host-controlled filesystem paths, so a concrete exploit needs a host application that forwards an attacker-influenced pathname into `UnixType.init(path:)`. ## Mitigations 1. Upgrade to the version of `apple/containerization` containing the fix. 2. If you can't upgrade immediately, validate that any Unix-domain socket pathname reaching `UnixType.init(path:)` is well under 104 bytes before calling it. 3. Don't let externally-influenced values (registry-supplied image metadata, network input, etc.) reach a Unix-socket relay path or any other caller of `UnixType.init(path:)` without going through your own length check first. ## References https://github.com/apple/containerization/pull/917
- Severity from
- GitHub (reviewed advisory)