bugGNU tar - Bugs: bug #62387, [SECURITY] Heap Buffer Overflow

 
 

bug #62387: [SECURITY] Heap Buffer Overflow

Submitter:  Carlos Andres Ramirez <carlos_ramirez>
Submitted:  Sat 30 Apr 2022 08:58:25 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  gray
Open/Closed:  Closed

Discussion locked!

  Spam posted by _341921
Sat 11 Feb 2023 10:07:43 AM UTC, comment #2: 

Fixed in commit 3da78400eafcccb97e2f2fd4b227ea40d794ede8

Sergey Poznyakoff <gray>
Group administrator
Wed 11 Jan 2023 09:01:16 AM UTC, comment #1: 

I created a patch #10307 fixing this issue.

Matej Mužila <mmuzila>
Sat 30 Apr 2022 08:58:25 AM UTC, original submission:  

A Heap Buffer Overflow exists in GNU Tar 1.34. The issue takes place at from_header() in list.c in the tar application. The issue occurs when attempting to read files with old V7 tar format with an especially crafted checksum.

As a result, an invalid memory read that leads to a conditional jump or move operation on uninitialised memory values takes place. Exploitation of this issue leads to code execution or DOS attacks and could potentially result in other memory-related issues.

Attached to this report is a PoC malcrafted file "vuln.tar"
VALGRIND OUTPUT:
...
==17455== Command: tar -xf vuln.tar -O
==17455==
==17455== Conditional jump or move depends on uninitialised value(s)
==17455==    at 0x1293AC: ??? (in /usr/bin/tar)
==17455==    by 0x12A010: ??? (in /usr/bin/tar)
==17455==    by 0x12B398: ??? (in /usr/bin/tar)
==17455==    by 0x112ECA: ??? (in /usr/bin/tar)
==17455==    by 0x48CB7FC: (below main) (libc-start.c:332)
==17455==
==17455== Invalid read of size 1
==17455==    at 0x1293B2: ??? (in /usr/bin/tar)
==17455==    by 0x12A010: ??? (in /usr/bin/tar)
==17455==    by 0x12B398: ??? (in /usr/bin/tar)
==17455==    by 0x112ECA: ??? (in /usr/bin/tar)
==17455==    by 0x48CB7FC: (below main) (libc-start.c:332)
==17455==  Address 0x4b4cf30 is 0 bytes after a block of size 14,336 alloc'd
==17455==    at 0x483F7B5: malloc (vg_replace_malloc.c:381)

NOTE: Compilation with ASAN confirms the vulnerability.

I will update the ticket if I can manage to find out more.
---
Carlos Andres Ramirez - Security Engineer <carlos_ramirez>
https://carlos.engineer


Carlos Andres Ramirez <carlos_ramirez>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #53164:  tar-1.34_ASAN.png added by carlos_ramirez (274KiB - image/png)
file #53162:  vuln.tar added by carlos_ramirez (512B - application/x-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by _341921 (Posted a comment)
  • -email is unavailable- added by mmuzila (Posted a comment)
  • -email is unavailable- added by gray (Updated the item)
  • -email is unavailable- added by carlos_ramirez (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-03-28 gray Discussion LockNone Locked
    2023-02-11 gray StatusNone Fixed
        Assigned toNone gray
        Open/ClosedOpen Closed
    2022-10-22 gray PrivacyPrivate Public
    2022-04-30 carlos_ramirez Attached File- Added tar-1.34_valgrind.png, #53163
        Attached File- Added tar-1.34_ASAN.png, #53164
    2022-04-30 carlos_ramirez Attached File- Added vuln.tar, #53162

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code