Mount Path Canonicalization Bypass in Virtual File System

JADAPTIVE identified and corrected a vulnerability in virtual filesystem path canonicalization and mount selection affecting Maverick SSH server products.

Certain non-canonical path representations could cause the virtual filesystem to select a less restrictive parent mount instead of the intended child mount.

In affected configurations, this could allow operations to bypass access restrictions enforced by the child mount.

A user may be able to access files or perform operations using the permissions of a parent mount instead of the more restrictive policy associated with a child mount.

Depending on the configuration, this could result in unauthorized read or write access to files that would otherwise be protected by the child mount.

The vulnerability requires a nested or overlapping mount configuration where the child mount's backing storage is accessible through the parent mount, and the child mount enforces a more restrictive policy.

Applications without such a configuration may not be exposed to this particular mount-selection bypass.

The vulnerability results from inconsistent canonicalization of virtual filesystem paths before mount selection.

In affected implementations, duplicate separators, dot segments, parent segments and certain separator representations were not consistently normalized before mount prefix matching.

Consequently, different representations of an equivalent path could be interpreted differently during mount selection and subsequent backing-store resolution.

A path intended for a restrictive child mount could instead be routed through the parent mount's file factory, allowing the operation to be evaluated using the parent's permissions.

Under normal operation, requests targeting /shared should be handled by the child mount and subject to its read-only policy.

In affected implementations, a non-canonical representation of a path under /shared could fail to select the child mount and instead be processed through the parent mount.

Because the child directory is also reachable through the parent mount's backing storage, this could allow an operation that the child mount would otherwise deny.

This example illustrates the required configuration. The vulnerability does not imply that all Maverick virtual filesystem deployments are affected.

The correction ensures that virtual paths are consistently canonicalized before the security-sensitive mount-selection decision.

The remediation includes:

Mount selection and backing-store resolution now operate on a consistent canonical representation of the requested virtual path.

Regression testing confirms that non-canonical representations cannot bypass the intended child mount's policy in the affected test configurations.

Customers should upgrade to the appropriate fixed release.

Applications using nested or overlapping virtual filesystem mounts should review whether more restrictive child mounts are backed by storage reachable through less restrictive parent mounts.

Customers who require assistance evaluating their configuration or upgrading should contact JADAPTIVE Support.