Bug 898176 – <app-arch/tar-1.34-r3: Heap buffer due to from_header() function performing an invalid read in list.c

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description nobarakat 2023-02-27 18:29:45 UTC]

There's a heap buffer overflow vulnerability that can be caused when tar attempts to read files with the old V7 tar format.

A fix commit exists in master but will need to be cherry-picked to the current release since no release has been made yet by upstream tar. I intend to submit a patch in app-arch/tar to include the patch in version 1.34

Relevant links:
tar bug: https://savannah.gnu.org/bugs/?62387
NVD link: https://nvd.nist.gov/vuln/detail/CVE-2022-48303
fix commit: 3da78400eafcccb97e2f2fd4b227ea40d794ede8 in branch master in the tar repo

[Comment 1 Sam James 2023-02-28 03:24:31 UTC]

Thanks!

[Comment 2 nobarakat 2023-03-15 00:28:41 UTC]

Hey folks, any word on this bug?

[Comment 3 nobarakat 2023-03-15 00:29:22 UTC]

(In reply to nobarakat from comment #2)
> Hey folks, any word on this bug?

Just fyi, I opened a PR for this one a while back

https://github.com/gentoo/gentoo/pull/29776

[Comment 4 Larry the Git Cow 2023-03-25 03:32:55 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3d066acd267ec8028a79f4d085614245190f2a8a

commit 3d066acd267ec8028a79f4d085614245190f2a8a
Author:     Nobel Barakat <[e-mail]>
AuthorDate: 2023-02-24 22:48:47 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-03-25 03:32:33 +0000

    app-arch/tar: Adding a patch to fix CVE-2022-48303
    
    This patch is cherry-picked from the upstream gnu/tar repository
    which fixes a heap buffer overflow issue in the utility. This fix is
    needed to resolve CVE-2022-48303.
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: Nobel Barakat <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/29776
    Signed-off-by: Sam James <[e-mail]>

 .../tar/files/tar-1.34-fix-cve-2022-48303.patch    | 32 ++++++++
 app-arch/tar/tar-1.34-r3.ebuild                    | 94 ++++++++++++++++++++++
 2 files changed, 126 insertions(+)

[Comment 5 Hans de Graaff 2023-10-04 12:07:59 UTC]

Ping. Can tar-1.34-r2 be removed?

[Comment 6 Hans de Graaff 2024-02-10 10:25:18 UTC]

Ping: please remove the vulnerable version.

[Comment 7 Larry the Git Cow 2024-02-18 07:20:16 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a55c0cc55ed9e9465d01ae2a2d8397b708eb7cfe

commit a55c0cc55ed9e9465d01ae2a2d8397b708eb7cfe
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-02-18 07:18:24 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-02-18 07:20:12 +0000

    [ GLSA 202402-12 ] GNU Tar: Out of Bounds Read
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202402-12.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 8 Larry the Git Cow 2024-02-18 07:24:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb7dbcdc8eac8d51da7ef162f249ac7f8d7e11c1

commit fb7dbcdc8eac8d51da7ef162f249ac7f8d7e11c1
Author:     Hans de Graaff <[e-mail]>
AuthorDate: 2024-02-18 07:23:26 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-02-18 07:24:01 +0000

    app-arch/tar: drop 1.34-r2
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: Hans de Graaff <[e-mail]>

 app-arch/tar/tar-1.34-r2.ebuild | 102 ----------------------------------------
 1 file changed, 102 deletions(-)