Bug 2121292 (CVE-2021-33644)

Summary: CVE-2021-33644 libtar: out-of-bounds read in gnu_longname
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: huzaifas, kdudka, praiskup
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with size in header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2121325, 2121300    
Bug Blocks: 2117835    

Description Sandipan Roy 2022-08-25 05:11:32 UTC
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807

Comment 1 Sandipan Roy 2022-08-25 05:19:32 UTC
Created libtar tracking bugs for this issue:

Affects: fedora-all [bug 2121300]

Comment 3 Kamil Dudka 2022-08-25 15:03:36 UTC
The security fixes in question seem to be available in this source RPM package: https://repo.openeuler.org/openEuler-22.03-LTS/update/source/Packages/libtar-1.2.20-21.oe2203.src.rpm