Technical impact
The tar-rs library includes a unpack_dir function that performs a metadata check on paths during extraction. Because the check uses fs::metadata(), which follows symbolic links, a malicious tarball that places a symlink entry immediately before a directory entry of the same name allows the extractor to treat the symlink target as a valid directory and apply chmod to it. This flaw permits an attacker to change the permissions of any directory that the symlink points to, even if that directory lies outside the intended extraction root. The vulnerability enables unauthorized modification of directory permissions, potentially facilitating privilege escalation or further compromise of the host system.
Affected Systems
The affected library is tar-rs, maintained by alexcrichton. Vulnerable versions include 0.4.44 and all earlier releases. The component is used in Rust projects that perform tar archive extraction.
Risk and Exploitability
The CVSS base score is 5.1, indicating moderate severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivering a crafted tar archive to a process that uses tar-rs for extraction, which is typically via software that accepts user-supplied archives. While the risk is moderate, the lack of widespread public exploitation and the dependency on a malicious tarball make immediate internal patching a prudent measure.
Github GHSA
Ubuntu USN