Technical impact
This vulnerability is a time‑of‑check to time‑of‑use race in GNU tar’s handling of incremental dumpdir 'X' rename operations. The flaw allows a local attacker who can write to a directory included in a backup to influence the restore process. Because the rename logic does not properly validate target paths, the attacker can cause files or folders to be created, renamed, or overwritten outside the intended extraction directory. This can result in unauthorized modification of system files and, in certain configurations, provide a foothold for privilege escalation. The weakness is identified as CWE‑367.
Affected Systems
Affected products include Red Hat Enterprise Linux versions 6, 7, 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The CPE strings list also reference the Hummingbird component. No specific version numbers are supplied beyond the product names.
Risk and Exploitability
The CVSS score of 4.4 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have local write access to a backed‑up directory and to be able to perform a restore on the target system, making the attack vector local. Because the flaw is not mitigated by common backup procedures such as creating a fresh extraction directory or omitting the -P option, the primary defense is process‑level controls rather than software patches.
