Bug 2552117

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

BusyBox dpkg-deb extraction can escape the extraction root directory via a crafted .deb archive exploiting the per-ar-member deferred symlink flush ordering. In archival/libarchive/get_header_ar.c:133, create_links_from_list(sa->link_placeholders) is called inside the per-ar-member loop, flushing deferred unsafe symlinks after each data.tar member is extracted. In contrast, tar (archival/tar.c:1269), cpio (archival/cpio.c:578), and unzip (archival/unzip.c:1059) all flush deferred symlinks once after the last archive member. The ar(5) format permits duplicate member names, and BusyBox's find_list_entry() (archival/libarchive/find_list_entry.c:15) matches with fnmatch(), so a single .deb can carry two accepted data.tar members. A crafted .deb with two uncompressed data.tar members: the first declaring a symlink 's -> /' (which is deferred as unsafe), the second declaring a regular file 's/etc/profile.d/zz-poc.sh' (no '..' in the name) results in the symlink being flushed to disk after member 1, then the file in member 2 resolving through the now-live symlink to /etc/profile.d/zz-poc.sh. Introduced by commit 8c24af9dc (2018-05-22). Affects 1_29_0 through master. No fixing commit exists. Independent static verification (2026-10-13, Kaiden/Opus) confirms reporter. Members must be uncompressed data.tar. Reported by Shubham Raj, Causal Security (https://causalsecurity.com). PSIRTSUPT-23314.