`UnixType.init(path:)` uses a macOS length limit longer than the `sockaddr_un.sun_path` buffer it copies into

## Impact An attacker who can influence the Unix-domain socket pathname that a macOS host application passes into `UnixType.init(path:)` can supply a pathname of 105–252 UTF-8 bytes to overflow the stack-allocated `sockaddr_un` before any socket syscall runs, corrupting the host process's stack. This requires a host application to accept an attacker-influenced pathname and forward it to this initializer — for example, through `Containerization`'s Unix-socket relay configuration — rather than being reachable directly from a container guest or a registry. The confirmed effect is stack corruption and process abort under memory-safety instrumentation. ## Details `UnixType.init(path:)` checks a candidate path's UTF-8 byte length against `lengthLimit` before copying it into the native `sockaddr_un.sun_path` field. On macOS that limit was hardcoded to 253 bytes, unrelated to `sun_path`'s actual 104-byte capacity. In Swift, `sockaddr_un` has a fixed Swift-visible size, and `UnixType.init(path:)` stack-allocates exactly that fixed-size value. The initializer then copies `nameLength` bytes into `sun_path` via `strncpy`, so any path accepted by the 253-byte check but longer than 104 bytes overflows past the entire stack-allocated struct, not just past the `sun_path` field, writing 1–148 attacker-controlled bytes into adjacent stack memory. ## Affected code - `UnixType.init(path:)` in `Sources/ContainerizationOS/Socket/UnixType.swift` — used a macOS-specific `lengthLimit` of 253 bytes to gate a copy into the 104-byte `sun_path` field. Not affected: the Linux branch of the same initializer, which already derived `lengthLimit` from `sun_path`'s actual size. Triggering this also requires an application-level path: the in-repository relay call sites (`Sources/Containerization/UnixSocketRelay.swift`) use host-controlled filesystem paths, so a concrete exploit needs a host application that forwards an attacker-influenced pathname into `UnixType.init(path:)`. ## Mitigations 1. Upgrade to the version of `apple/containerization` containing the fix. 2. If you can't upgrade immediately, validate that any Unix-domain socket pathname reaching `UnixType.init(path:)` is well under 104 bytes before calling it. 3. Don't let externally-influenced values (registry-supplied image metadata, network input, etc.) reach a Unix-socket relay path or any other caller of `UnixType.init(path:)` without going through your own length check first. ## References https://github.com/apple/containerization/pull/917

Severity from

GitHub (reviewed advisory)

• github.com/apple/containerization/security/advisories/GHSA-rgqp-277h-gcwj
• github.com/apple/containerization