Listen to this Post
The vulnerability in astral-tokio-tar is a boundary parsing flaw arising from inconsistent handling of PAX extended headers and standard ustar headers. When parsing a TAR archive, PAX headers can specify metadata overrides, including the true size of a file entry. The vulnerable versions (prior to 0.5.6) incorrectly used the file size from the primary ustar header (which could be zero) to calculate the stream position for the next archive entry, instead of using the overridden size from the PAX headers. This miscalculation causes the parser to advance an incorrect number of bytes. Consequently, if the file data of the current entry contains byte sequences that form valid TAR headers, the parser will misinterpret this inner content as a new, legitimate entry from the outer archive. This desynchronization allows an attacker to “smuggle” malicious files into the extraction process, bypassing the intended structure of the archive.
Platform: Rust crate
Version: <0.5.6
Vulnerability : Boundary confusion
Severity: Critical
date: 2025-10-21
Prediction: 2025-10-21
What Undercode Say:
Creating a malicious TAR with a PAX size override and a fake internal header. echo "Creating malicious archive structure..." tar --format=pax -cvf exploit.tar --pax-option="size=1024" fake_file.bin echo -n "USTAR_HEADER_BYTES" >> exploit.tar Simulating the parser's incorrect position calculation. dd if=exploit.tar bs=512 skip=1 2>/dev/null | hexdump -C | head -n 2
// Code snippet demonstrating the root cause
// Vulnerable position calculation using ustar header size
let file_size = header.size(); // Returns 0, ignoring PAX 'size=1024'
let next_pos = current_pos + 512 + pad_to_512(file_size); // Advances only 512 bytes
// Fixed calculation applying PAX overrides first
let mut file_size = header.size();
if let Some(pax_size) = pending_pax.get("size") {
file_size = pax_size.parse().unwrap(); // Correctly uses 1024
}
let next_pos = current_pos + 512 + pad_to_512(file_size); // Correctly advances 1536 bytes (512 + 1024 + padding)
How Exploit:
Craft a TAR archive with a PAX header specifying a large file size and a ustar header declaring a size of zero. The file data must begin with a sequence of bytes that form a valid TAR header for a malicious file. Upon extraction, the parser will incorrectly advance only 512 bytes, then immediately interpret the crafted header within the file data as a new archive entry, writing the smuggled file to disk.
Protection from this CVE
Upgrade to version 0.5.6 or later of the `astral-tokio-tar` crate. This version correctly applies PAX metadata overrides before calculating file data boundaries and stream positions. There are no effective workarounds for versions prior to 0.5.6.
Impact:
Arbitrary file write, potential code execution, and credential exfiltration if the library is used to extract untrusted archives, as it allows an attacker to place files outside the expected extraction paths.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
