Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 898176 (CVE-2022-48303) - <app-arch/tar-1.34-r3: Heap buffer due to from_header() function performing an invalid read in list.c
Summary: <app-arch/tar-1.34-r3: Heap buffer due to from_header() function performing a...
Status: RESOLVED FIXED
Alias: CVE-2022-48303
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa+]
Keywords:
Depends on: 905287
Blocks:
  Show dependency tree
 
Reported: 2023-02-27 18:29 UTC by nobarakat
Modified: 2024-02-18 07:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description nobarakat 2023-02-27 18:29:45 UTC
There's a heap buffer overflow vulnerability that can be caused when tar attempts to read files with the old V7 tar format.

A fix commit exists in master but will need to be cherry-picked to the current release since no release has been made yet by upstream tar. I intend to submit a patch in app-arch/tar to include the patch in version 1.34

Relevant links:
tar bug: https://savannah.gnu.org/bugs/?62387
NVD link: https://nvd.nist.gov/vuln/detail/CVE-2022-48303
fix commit: 3da78400eafcccb97e2f2fd4b227ea40d794ede8 in branch master in the tar repo
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-02-28 03:24:31 UTC
Thanks!
Comment 2 nobarakat 2023-03-15 00:28:41 UTC
Hey folks, any word on this bug?
Comment 3 nobarakat 2023-03-15 00:29:22 UTC
(In reply to nobarakat from comment #2)
> Hey folks, any word on this bug?

Just fyi, I opened a PR for this one a while back

https://github.com/gentoo/gentoo/pull/29776
Comment 4 Larry the Git Cow gentoo-dev 2023-03-25 03:32:55 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3d066acd267ec8028a79f4d085614245190f2a8a

commit 3d066acd267ec8028a79f4d085614245190f2a8a
Author:     Nobel Barakat <nobelbarakat@google.com>
AuthorDate: 2023-02-24 22:48:47 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-03-25 03:32:33 +0000

    app-arch/tar: Adding a patch to fix CVE-2022-48303
    
    This patch is cherry-picked from the upstream gnu/tar repository
    which fixes a heap buffer overflow issue in the utility. This fix is
    needed to resolve CVE-2022-48303.
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: Nobel Barakat <nobelbarakat@google.com>
    Closes: https://github.com/gentoo/gentoo/pull/29776
    Signed-off-by: Sam James <sam@gentoo.org>

 .../tar/files/tar-1.34-fix-cve-2022-48303.patch    | 32 ++++++++
 app-arch/tar/tar-1.34-r3.ebuild                    | 94 ++++++++++++++++++++++
 2 files changed, 126 insertions(+)
Comment 5 Hans de Graaff gentoo-dev Security 2023-10-04 12:07:59 UTC
Ping. Can tar-1.34-r2 be removed?
Comment 6 Hans de Graaff gentoo-dev Security 2024-02-10 10:25:18 UTC
Ping: please remove the vulnerable version.
Comment 7 Larry the Git Cow gentoo-dev 2024-02-18 07:20:16 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a55c0cc55ed9e9465d01ae2a2d8397b708eb7cfe

commit a55c0cc55ed9e9465d01ae2a2d8397b708eb7cfe
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-02-18 07:18:24 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-02-18 07:20:12 +0000

    [ GLSA 202402-12 ] GNU Tar: Out of Bounds Read
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202402-12.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
Comment 8 Larry the Git Cow gentoo-dev 2024-02-18 07:24:08 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb7dbcdc8eac8d51da7ef162f249ac7f8d7e11c1

commit fb7dbcdc8eac8d51da7ef162f249ac7f8d7e11c1
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2024-02-18 07:23:26 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-02-18 07:24:01 +0000

    app-arch/tar: drop 1.34-r2
    
    Bug: https://bugs.gentoo.org/898176
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 app-arch/tar/tar-1.34-r2.ebuild | 102 ----------------------------------------
 1 file changed, 102 deletions(-)