Steve Beattie

Improper neutralization of special elements used in an OS command allows an actor who controls the `project id` or `storage bucket` inputs to execute arbitrary shell commands on the GitHub Actions runner. This occurs because these inputs are interpolated directly into Bash gcloud storage cp commands in several steps via `${{ inputs.* }}` expressions.

The software allows users to build and publish OCI container images from apk packages. A flaw exists in the `UserEntry.Parse` and `GroupEntry.Parse` functions within `pkg/passwd` when reading UID and GID fields from `/etc/passwd` and `/etc/group` entries. The system uses `strconv.Atoi` to convert these fields to `uint32` without performing a range check. On 64-bit platforms, negative values wrap and out-of-range values, such as 4294967296 (2^32), are truncated to 0. An attacker controlling a package installed into the image can provide an entry that appears to be an unprivileged UID or GID but is written into the final image as UID 0 or GID 0 (root). This truncated UID is also utilized when resolving the image's run-as user.

The issue is related to a one-byte out-of-bounds read in the `from header` function in `list.c` that results in the use of uninitialized memory for a conditional jump. This occurs via a V7 archive in which `mtime` has approximately 11 whitespace characters. Exploitation to change the flow of control has not been demonstrated.

The issue allows local users to read maps and smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition. This is due to a problem in the mm for maps function in fs/proc/base.c.