Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
facebook/soloader
main @ baa449c
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Insecure Permissions: 2 prior fixes. Scrutinize any change in this area.
java/com/facebook/soloader/UnpackingSoSource.java: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Attackers can bypass directory boundaries by embedding parent directory traversal sequences in native library names inside an APK, leading to arbitrary file write upon extraction. Ensure robust canonicalization and prefix validation on all extracted library filenames.
Insecure Permissions: Extracted shared library files and their containing directories could remain writable, opening up opportunities for dynamic library hijacking or local privilege escalation. Explicitly revoke write permissions immediately after unpacking to enforce executable integrity.