A Heap Buffer Overflow exists in GNU Tar 1.34. The issue takes place at from_header() in list.c in the tar application. The issue occurs when attempting to read files with old V7 tar format with an especially crafted checksum.

As a result, an invalid memory read that leads to a conditional jump or move operation on uninitialised memory values takes place. Exploitation of this issue leads to code execution or DOS attacks and could potentially result in other memory-related issues.

Attached to this report is a PoC malcrafted file "vuln.tar"
VALGRIND OUTPUT:
...
==17455== Command: tar -xf vuln.tar -O
==17455==
==17455== Conditional jump or move depends on uninitialised value(s)
==17455==    at 0x1293AC: ??? (in /usr/bin/tar)
==17455==    by 0x12A010: ??? (in /usr/bin/tar)
==17455==    by 0x12B398: ??? (in /usr/bin/tar)
==17455==    by 0x112ECA: ??? (in /usr/bin/tar)
==17455==    by 0x48CB7FC: (below main) (libc-start.c:332)
==17455==
==17455== Invalid read of size 1
==17455==    at 0x1293B2: ??? (in /usr/bin/tar)
==17455==    by 0x12A010: ??? (in /usr/bin/tar)
==17455==    by 0x12B398: ??? (in /usr/bin/tar)
==17455==    by 0x112ECA: ??? (in /usr/bin/tar)
==17455==    by 0x48CB7FC: (below main) (libc-start.c:332)
==17455==  Address 0x4b4cf30 is 0 bytes after a block of size 14,336 alloc'd
==17455==    at 0x483F7B5: malloc (vg_replace_malloc.c:381)

NOTE: Compilation with ASAN confirms the vulnerability.

I will update the ticket if I can manage to find out more.
---
Carlos Andres Ramirez - Security Engineer <carlos_ramirez>
https://carlos.engineer