BusyBox provides lightweight Unix utilities as a single binary. A path traversal vulnerability exists in the dpkg-deb extraction path in archival/libarchive/get_header_ar.c. The ar container handler flushes deferred symlinks (via create_links_from_list() at line 133) inside the per-member loop, rather than once after all members are processed. The tar, cpio, and unzip front-ends correctly flush deferred symlinks after the main loop (tar.c:1269, cpio.c:578, unzip.c:1059), but the ar path does not follow this pattern.

The deferred-symlink mechanism (unsafe_symlink_target.c:13) exists to prevent directory traversal: symlinks with absolute targets or '..' components are deferred until after all archive members are extracted, so that no subsequent member can traverse them. By flushing per ar member, the ar path breaks this invariant: a symlink deferred from the first data.tar member is placed on disk before the second data.tar member is parsed.

A crafted .deb containing two uncompressed data.tar ar members can exploit this: the first declares a symlink whose target is the filesystem root, and the second declares a regular file whose path is resolved through that live symlink, writing a file outside the extraction root.

Constraints: only uncompressed data.tar members work (compressed members cause setup_unzip_on_fd() to replace src_fd with a pipe, making the subsequent lseek fail). filter_accept_list_reassign() does not remove matched entries from the accept list, so duplicate member names are accepted. BB_SUID_DROP is set for the dpkg-deb applet, preventing setuid escalation.

The reporter states the bug was introduced by commit 8c24af9dc (2018-05-22), affecting versions 1_29_0 through current master. No fixing commit exists. Reproduced on Fedora busybox-1.37.0-7.fc44, Debian 13, and Ubuntu 24.04 LTS.

Reported by Shubham Raj, Causal Security.
PSIRT ticket: PSIRTSUPT-23314.