Bug 2533007 (CVE-2026-90954)

Summary:	CVE-2026-90954 busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2552117, 2552118
Bug Blocks:

Description OSIDB Bzimport 2026-09-14 11:59:24 UTC

BusyBox provides lightweight Unix utilities as a single binary. A path traversal vulnerability exists in the dpkg-deb extraction path in archival/libarchive/get_header_ar.c. The ar container handler flushes deferred symlinks (via create_links_from_list() at line 133) inside the per-member loop, rather than once after all members are processed. The tar, cpio, and unzip front-ends correctly flush deferred symlinks after the main loop (tar.c:1269, cpio.c:578, unzip.c:1059), but the ar path does not follow this pattern.

The deferred-symlink mechanism (unsafe_symlink_target.c:13) exists to prevent directory traversal: symlinks with absolute targets or '..' components are deferred until after all archive members are extracted, so that no subsequent member can traverse them. By flushing per ar member, the ar path breaks this invariant: a symlink deferred from the first data.tar member is placed on disk before the second data.tar member is parsed.

A crafted .deb containing two uncompressed data.tar ar members can exploit this: the first declares a symlink whose target is the filesystem root, and the second declares a regular file whose path is resolved through that live symlink, writing a file outside the extraction root.

Constraints: only uncompressed data.tar members work (compressed members cause setup_unzip_on_fd() to replace src_fd with a pipe, making the subsequent lseek fail). filter_accept_list_reassign() does not remove matched entries from the accept list, so duplicate member names are accepted. BB_SUID_DROP is set for the dpkg-deb applet, preventing setuid escalation.

The reporter states the bug was introduced by commit 8c24af9dc (2018-05-22), affecting versions 1_29_0 through current master. No fixing commit exists. Reproduced on Fedora busybox-1.37.0-7.fc44, Debian 13, and Ubuntu 24.04 LTS.

Reported by Shubham Raj, Causal Security.
PSIRT ticket: PSIRTSUPT-23314.