Bug 2521857 (CVE-2026-78367)
| Summary: | CVE-2026-78367 rpm: rpmbuild getTarSpec() crafted tar member name → macro injection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2521902 | ||
| Bug Blocks: | |||
When rpmbuild runs in tarball mode (-ta / -tb / -ts, etc.), getTarSpec() extracts a .spec from the archive and renames it using the member name from tar’s verbose listing. That member name is concatenated into: specFinal = rpmExpand("%{_specdir}/%{basename:", tarbuf, "}", NULL); A crafted .spec member name containing } closes %{basename:...} early. Text after the } is expanded as further RPM macros, including %{lua:} (full Lua stdlib, rpm.execute / rpm.spawn). The expanded string is used as the destination of rename() and as the spec path for the rest of the build. This happens while locating the spec — before %prep. It is not “spec scripts run shell by design.” The victim only needs to run rpmbuild -ts (or -ta / -tb) on a crafted tarball. This is a sibling / variant of CVE-2026-44604: untrusted archive metadata (here: tar member name; there: ZIP/7z/GEM top-level directory) is interpolated into a privileged expand/popen path. Different call site (getTarSpec vs rpmuncompress), same trust-boundary class. CVE-2026-44604 did not fix this path.