A stack overflow in GNU Tar

[kerneldude]

A stack overflow vulnerability exists in GNU Tar up to including v1.34, as far as I can see, Ubuntu is using v1.3.
The bug exists in the function xattr_decoder() in xheader.c, where alloca() is used and it may overflow the stack if a sufficiently long xattr key is used. The vulnerability can be triggered when extracting a tar/pax archive that contains such a long xattr key.

Vulnerable code: https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723

PoC tar archive is attached in a zip archive to reduce the size.

I reported the vulnerability yesterday to GNU Tar maintainers and they replied that the issue was fixed in the version that was released two weeks ago:

"Sergey fixed that bug here:

https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4

and the fix appears in tar 1.35, released July 18.
"

[Eduardo Barretto (ebarretto)]

Hey,

Thanks for taking the time to report this bug and helping to make Ubuntu better.
Do you know if this issue ever got a CVE assigned?
Also are you ok with me making this bug public since the fix is already public and released?

[kerneldude (kerneldude)]

Hi,

> Do you know if this issue ever got a CVE assigned?
I requested a CVE from MITRE today, awaiting a response.

> Also are you ok with me making this bug public since the fix is already
public and released?
Sure, go ahead.

Thanks,
Bahaa

On Thu, Aug 3, 2023 at 6:44 PM Eduardo Barretto <email address hidden>
wrote:

> Hey,
>
> Thanks for taking the time to report this bug and helping to make Ubuntu
> better.
> Do you know if this issue ever got a CVE assigned?
> Also are you ok with me making this bug public since the fix is already
> public and released?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/2029464
>
> Title:
> A stack overflow in GNU Tar
>
> Status in tar package in Ubuntu:
> New
>
> Bug description:
> A stack overflow vulnerability exists in GNU Tar up to including v1.34,
> as far as I can see, Ubuntu is using v1.3.
> The bug exists in the function xattr_decoder() in xheader.c, where
> alloca() is used and it may overflow the stack if a sufficiently long xattr
> key is used. The vulnerability can be triggered when extracting a tar/pax
> archive that contains such a long xattr key.
>
> Vulnerable code:
>
> https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723
>
> PoC tar archive is attached in a zip archive to reduce the size.
>
> I reported the vulnerability yesterday to GNU Tar maintainers and they
> replied that the issue was fixed in the version that was released two
> weeks ago:
>
>
> "Sergey fixed that bug here:
>
>
> https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4
>
> and the fix appears in tar 1.35, released July 18.
> "
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2029464/+subscriptions
>
>

[Alex Murray (alexmurray)]

@kerneldude - do you know if MITRE ever assigned a CVE for this?

[kerneldude (kerneldude)]

Yes, they reserved one, but with no details:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39804

Feel free to assign a different one with information about the issue, or update the already reserved CVE number.

[Alex Murray (alexmurray)]

Excellent - thanks for letting us know. So since a CVE has already been assigned then we won't assign an additional one. I'll add the details to our CVE tracker.

[Alex Murray (alexmurray)]

@kerneldude - any chance you could share your poc (perhaps email it to <email address hidden> rather than post it publicly here)? I have tried creating one via the following but I hit the CLI args limit before I can get an xattr key long enough:

touch bar
tar --pax-option SCHILY.xattr.user.$(python3 -c "print('a'*131048)"):=test -cf poc-crafted.tar bar

[Alex Murray (alexmurray)]

So I managed to create a tar file with an extended attribute name of length of ~ 999936 bytes long (the largest I can do without exceeding the existing check on maximum extended header lengths it seems) but this is not able to trigger the vuln - so if you are able to share your PoC that would be great.

[Alex Murray (alexmurray)]

Actually I just got it working - no need to send PoC @kerneldude - I made my own.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tar - 1.34+dfsg-1.2ubuntu2

---------------
tar (1.34+dfsg-1.2ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: stack overflow via crafted xattr (LP: #2029464)
    - debian/patches/CVE-2023-39804.patch: allocate xattr keys and values
      on the heap rather than the stack in src/xheader.c
    - CVE-2023-39804

 -- Alex Murray <email address hidden> Tue, 05 Dec 2023 15:39:15 +1030