Debian FreedomBox symlink flaw enables unauthorized file read and write

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.

• Debian FreedomBox: versions before 26.15 are affected. The normalized product entry expresses the range as starting at 0 and ending before 26.15, with default status unaffected.
• The project advisory confirms that the following supported deployments were affected: 26.14 in stable-backports/testing/unstable, 25.9.3+deb13u1 in stable, and 23.6.2+deb12u1 in oldstable.
• FreedomBox is a Debian Pure Blend and distributes its software through Debian repositories. The available evidence identifies 26.15 as the FreedomBox fix boundary, but does not provide exact fixed Debian package versions for the stable or oldstable branches.

The affected component is FreedomBox's SSH user-key management path, including handling of the authorized_keys file. The vulnerable behavior allowed privileged code to read and write this path on behalf of a user account. This is CWE-61, where filesystem symlink resolution can cause the target file to be accessed with the privileges of the operation performing the read or write. Because the user can control the authorized_keys symlink condition, the path can be redirected to a file outside that account's permitted access. The fixing commit moves the read and write operations to the user account's privileges through mechanisms such as action_utils.run_as_user and tee, while retaining ownership and permission handling. The commit's tests show that a link to /etc/shadow no longer permits reading its contents or writing keys, and that linking the .ssh directory to /etc is also rejected. Public evidence does not fully establish every path validation check or every reachable call site in each deployment.

The flaw is locally reachable rather than directly network reachable. The normalized record characterizes the attack as low complexity, requiring no user interaction and no additional privileges under its assessment model; the project advisory warns that systems with non-administrator users are affected. The attacker-controlled condition is making the authorized_keys path a symlink. The supplied record marks public exploit as false, but its known-exploited status is unspecified, so the evidence does not establish that real-world abuse has not occurred. No specific campaign or indicator of compromise is identified in the available evidence.

An attacker may be able to read sensitive data or write data to files that the account should not access. The practical result depends on the file selected as the symlink target and the privileges available to the processing code, but possible consequences include data disclosure, configuration changes, and service disruption. The supplied assessment keeps scope unchanged and does not document a separate privilege-escalation path. Even so, reading and writing with privileges higher than those of the account can materially affect system confidentiality, integrity, and availability.

Successful abuse could expose the contents of files that the account should not read, alter protected files, or damage files relied on by the system. Because the issue affects both reads and writes, confidentiality, integrity, and service availability may be affected. The project advisory specifically identifies FreedomBox systems with non-administrator users as exposed. The evidence does not identify a breach, victim, or particular file that was altered.

1. Upgrade FreedomBox to 26.15, the fixed release identified by the normalized affected range. Do not infer from this that parallel Debian package branches use the same fixed version.
2. For systems running the Debian stable or oldstable branches listed in the advisory, apply the Debian update that contains the fix. The available evidence does not establish the exact fixed package version for either branch.
3. Until the update can be applied, if non-administrator users are present, open System -> Secure Shell Server and disable Allow all users to login remotely. According to the project advisory, only users in the admin or freedombox-ssh groups, or the system sudo group, will then be able to connect through SSH. This is a temporary mitigation, not a substitute for updating.
4. After updating, inspect users' .ssh/authorized_keys files and .ssh directories for unauthorized symlinks, and assess or restore any files showing signs of modification.

1. Inventory FreedomBox systems and identify the Debian package branch in use, then compare it with the affected boundaries in the affected summary.
2. Identify systems with non-administrator accounts, because the project advisory specifically treats those deployments as exposed.
3. Check the metadata of each user's .ssh/authorized_keys file and .ssh directory for unexpected symlinks, taking care not to follow the link automatically during inspection.
4. Review logs and SSH key-management events for failures involving Unable to set SSH keys. This is a defensive review point derived from the fixing commit's tests, not a confirmed indicator of compromise.
5. Recheck the installed version after updating. The absence of a suspicious symlink or log error does not prove safety if the installed version remains affected.