Cloudanix VulnDB

CVE-2023-39804

None

CVSS

—

EPSS

0.3%

Published

Mar 27, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the tar program can make it stop working when it tries to read certain archive files.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Denial Of Service
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Mishandled extension attributes in PAX archives trigger invalid input processing that causes an application crash inside xheader.c.

Why it matters to the business

Tar-based backup, restore, and packaging workflows can be interrupted when a crafted archive is processed, leading to failed operations and potential data-handling delays.

How an attack unfolds

An attacker crafts a PAX archive containing malformed extension attributes, then supplies the archive to a victim who extracts or lists it with a vulnerable tar binary, causing the crash.

How to fix it

Upgrade GNU tar to version 1.35 or later; the fix is present in commit a339f05cd269013fa133d2f148d73f6f7d4247e4.

How to confirm the fix worked

Confirm tar version is 1.35 or newer; test extraction of a PAX archive containing extension attributes to verify no crash occurs.

Typical attack path

  1. Craft PAX archive with invalid extension attributes
  2. Deliver archive via email, download, or shared storage
  3. Victim invokes tar on the archive
  4. Crash occurs during attribute parsing in xheader.c

How to detect it

Review system and application logs for tar segmentation faults or abrupt exits when processing PAX archives; correlate with file-access timestamps of suspicious archives.

What your security team should do

  • Upgrade all instances of GNU tar to 1.35 or newer
  • Replace tar in build pipelines and container images with the fixed version
  • Monitor tar process terminations during archive operations

The record

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 tar 0 1.30+dfsg-6+deb10u1
Debian:11 tar 0 1.34+dfsg-1+deb11u1
Debian:12 tar 0 1.34+dfsg-1.2+deb12u1
Debian:13 tar 0 1.34+dfsg-1.3
SUSE:Linux Enterprise Micro 5.1 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Micro 5.2 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Micro 5.3 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Micro 5.4 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Micro 5.5 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Module for Basesystem 15 SP4 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 tar 0 1.34-150000.3.34.1
SUSE:Linux Enterprise Server 12 SP5 tar 0 1.27.1-15.24.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 tar 0 1.27.1-15.24.1
Ubuntu:20.04:LTS tar 0 1.30+dfsg-7ubuntu0.20.04.4
Ubuntu:22.04:LTS tar 0 1.34+dfsg-1ubuntu0.1.22.04.2
Ubuntu:23.10 tar 0 1.34+dfsg-1.2ubuntu1.1
Ubuntu:Pro:14.04:LTS tar 0 1.27.1-1ubuntu0.1+esm4
Ubuntu:Pro:16.04:LTS tar 0 1.28-2.1ubuntu0.2+esm3
Ubuntu:Pro:18.04:LTS tar 0 1.29b-2ubuntu0.4+esm1
openSUSE:Leap 15.4 tar 0 1.34-150000.3.34.1
openSUSE:Leap 15.5 tar 0 1.34-150000.3.34.1
openSUSE:Leap Micro 5.3 tar 0 1.34-150000.3.34.1
openSUSE:Leap Micro 5.4 tar 0 1.34-150000.3.34.1
openSUSE:Tumbleweed tar 0 1.35-2.1

Related vulnerabilities